RFC: Alikins/jks keystore

This changes the deploy scripts and some cert gen scripts to use a JKS keystore by default.

The main reasons for doing that are that keytool, and other assorted tools don't like to import "trusted" certs into pkcs12 keystores. For a self sign scenario, this is okay. But if we want to provide or generates a CA cert, and then
import it, and use it to generate the tomcat/apache server cert with it, we need to be able to import the trusted CA cert. 

This also switches from generating and deploying a self signed server cert, and instead generating a CA cert, self signing that, importing it into the keystore, then using it to generate server certs. 

This also creates a server cert specifically for tomcat, that is imported into our keystore, and another pem style
certificate that we can use with mod_ssl/apache  (It should be possible to use the same cert for both, with the appropriate format conversions/and or custom cert loading code, but then, there is also no particular need to use the same certificate).

What this doesn't cover yet:
- migrating pkcs12 keystores to jks keystores 
- Using a provided CA cert instead of generating a fresh one.