Even for a entitlement certificate installer class, that is kind of weird.

This class really needs a decomposition between "EntitlementCertsInfo" that knows whats installed, whats new, whats old, whats rogue, what mising, etc. And something... that knows how to apply that info. I think the
EntitleCertBundlesInstaller class was a start on that...

May be useful to keep the idea in mind that we will likely need to start installing entitlements certs by adding them to an nss store.

But... entdir isn't a terrible abstraction for the "cert directory" operations. EntCertBundlesInstallers kind of goes the opposite direction. Now I'm unsure what makes more sense... a certdb that knows it's certs, or a cert that knows it's certdb