Adapt to NewTLSClient change in go-etcd, add CaKeys support

This is needed to compile `confd` against anything after coreos/go-etcd@51a26f8d6a, which deprecates `SetCertAndKey` and requires a CA certificate chain.

Test suite seems to pass and the binary is working for me.  Otherwise I don't see much in the way of contribution guidelines, so let me know if there anything else I should do.