ssl: Add playbook for constrained deploy

We need a playbook to quickly and surgically update the SSL certificates of a cluster without needing to bounce all services or take a control plane outage. This playbook provides that ability.
There are a lot of unrelated items in the common role, do we want to just add the new certificate to the trusted certs?