[WIP] Certmonger ca

- default postgres pg_hba.conf works for 95% of our machines
- move certs directory from postgres to central location `/var/www/miq/vmdb/certs`

QUESTIONS:
should sneakernet (PoC CA) be its own rpm?

outstanding:

- [ ] convert `appliance_console` (internal, external, regional) to use `getcert`, add ca name flag
- [ ] convert selinux `cmsec.te` into a flag, and install in cfme-setup (flag set to false)
- [ ] convert guides to leverage new methods, adding step for setting flag to true
- [ ] change cfme-setup to use `semanage` instead of `chcon`

Is options a Hash?  If so, a regular .each is sufficient.