Generate _main.ks

To generate _main.ks, you just need to run |make certs| (keytool and mekeytool should be in your path).
|make certs| isn't run by default, because we don't want to re-generate _main.ks for each build but only when we want to add new certs (this allows people to build without keytool and mekeytool).
Add make -C certs clean to the list of commands in this recipe for `make clean`.