Cockpit UID/GID separation

Instead of running ```cockpit-ws``` as root, run it with an unprivileged ```cockpit-ws``` uid/gid. This removes the risk of running such a complex process as root, including a bunch of GLib code.

This means that ```cockpit-session``` becomes setuid root, but since it's a much simpler process with very few dependencies, the idea is that it doesn't carry as much risk. In addition we don't mark it executable for everyone, only for those in the ```cockpit-ws``` group.

Since ```cockpit-ws``` is no unprivileged, it can't write to its certificate directory. This pull request also moves the self-signed certificate generation (in the absence of a real certificate) into a separate command, which is executed as an ```ExecStartPre``` by systemd.
Why twice?