(PE-6162) Initial docs

This commit does two things:

* Introduces some initial documentation about settings, known issues, etc.
* Splits the CA settings into their own config file for ezbake.
Rather than just "certnames" should we be more specific that the name must be an exact match to the Common Name  (CN) portion of the Distinguished Name in the client certificate's Subject Name.  Also, should we indicate that there is no support for wildcard matches?  And that an empty list means "deny all"?