Enable Authentication of Services

Right now we find services by either hardcoding their IP addresses or using the salt mine. While this means we can be reasonably sure that the IP address may be correct it does not however do anything to ensure that the service we are communicating with is the one we mean to be talking to. The canonical way to handle this is by using TLS, so this PR adds machinery to do that.

* Generates a 5 year CA on the first attempt to use it and distributes the root cert to all servers.
* Generates certificates signed by the above CA for the defined services and ensure they are available only to the servers for a specific role.
* All certificates created are short lived certificates (default of 1 day) and will be automatically replaced when they are at 25% of their lifetime.
* Moves the TLS certificates for the HTTPS load balancers (the ones signed by public CAs) so it's handled by the same system and setup haproxy to use them.
* Centralizes the cipher settings into a pillar.
* Switches PostgreSQL over to using the new system on the server side, clients still do not connect via TLS.
* Remove the now outdated attempt at a CA, ``psf-ca``.

The CA file is located at ``/etc/ssl/certs/PSF_CA.pem``. An example of validating it would be something like ``psql "postgresql://monitoring:insecurepasswordlol@postgresql.psf.io/monitoring?sslmode=verify-full&sslrootcert=/etc/ssl/certs/PSF_CA.pem&hostaddr=192.168.50.20"``

New certificates can be added by editing ``pillar/base/tls.sls`` and adding a new dictionary under ``gen_certs``.

This needs configuration on the salt master like:

```
extension_modules: srv/salt/_extensions

ext_pillar:
  - ca:
      name: PSF_CA
      cert_opts:
        C: US
        ST: NH
        L: Wolfeboro
        O: Python Software Foundation
        OU: Infrastructure Team
        emailAddress: infrastructure@python.org
```