Added client-side support for --matches on the list command.

- --matches with --installed or --consumed options use a
  client-side filtering implementation, where --available uses
  server-side.

- Fixed an issue which would cause output for --available or
  --consumed to be skipped if --installed or --available had
  zero objects to display.

- Updated the man pages and auto-complete accordingly.

- Abstracted out the filtering functionality to a collection of
  *CertificateFilter classes.

- Refactored much of the ListCommand operations involving filtering.