Upgrade CertificateAuthority to use certmonger

This modifies our certificate authority to speak with ipa and certmonger.

- modifies cli to provide help when no parameters are available
- adds `--postgres-client-cert`, `--postgres-server-cert`, and `--api-cert`.

The switches speak with IdM/IPA to register a service principle and download a certificate. This leverages the ipa and kerberos. Hence additions were made to the kerberos `Principal`, ssl `Certificate`, the orchestrator `CertificateAuthority` and the `Cli` that handles the user input.

User Flow.

1. Install an appliance.
2. Configures database connectivity (or creates an internal database)
3. Install `ipa-client` either in `appliance_console` or `appliance_console_cli`.

From an ssh prompt, verify your kerberos credentials and install the certificates:

```
kinit
appliance_console_cli --postgres-client-cert --postgres-server-cert
```

An appliance with a database needs the `postgres-server-cert`, and an appliances without a database only need the `postgres-client-cert`. An appliance with replication needs both the client and the server cert.


split out of #204

https://bugzilla.redhat.com/show_bug.cgi?id=1130658
also add `:owner => "root.root"` - ensure `"root.root"` works