afclient: support loading complete cert-chains from cerfile.

This makes x.509 certification more usable/maintainable,
because the intermediate CA keys don't all need to be
maintained on the server (the certification tools just need
to concatenate the CA chain onto the APF-client certificates
as part of the certification-process).