Add a script for generating CA signed certs, and a client cert.

@filbranden @jbeda Take a look.  @derekwaynecarr is there an easy way to get the IP address on a vagrant cluster?
As things stand, this command will run every time highstate is run.  We probably don't want that.

Options:
* Make the script a no-op if the cert already exists.
* Use the unless construct to only run if a file exists: `unless: test -f <cert name>`