remove IdentityCertificate and use ClaimsSet directly

'IdentityCertificate' was not a good type, containing duplicate
information in the JWT and other fields.  Instead define the
'certify' function, which builds a 'ClaimsSet' and immediately signs
it.

Also hide the 'SupportDocument' constructor and use a smart
constructor to ensure that no private key material appears in a
support document.  And while at it, add lenses :)
ci: disable sudo (use container stack)