ssl-ca: Allow CA certificate to be specified

Allow a CA certificate to be specified, and automatically add it to
the default system CA bundle via a new "ssl-ca" DIB element.

This is required for sites which use their own Certificate Authority.

This DIB element is safe to include on all images, regardless of
whether or not it is activated with a valid CA certificate.

Based on SSL PKI spec:
  I32473fe797a4c1e28d14c3b82c8892c7c59a4e55

Depends on t-h-t update for ssl.ca_certificate property via Heat:
  Ibacd7c98980520e11c0df89632013f2ba2dbe370

Change-Id: I3441b4b688aacb2bb8d8326ee72f87974dd554ff
Merge "ssl-ca: Allow CA certificate to be specified"