ssl: Add playbook for constrained deploy

We need a playbook to quickly and surgically update the SSL certificates of a cluster without needing to bounce all services or take a control plane outage. This playbook provides that ability.
I would feel much better about just running the ssl subtask.