InitKube.Certificate should be optional

[ErinCall]

Currently, internal/run.InitKube.Prepare returns an error if its Certificate field is empty (unless SkipTLSVerify is true). That was an error on my part! The kubeconfig only needs a certificate-authority-data field if the cluster CA is using a self-signed certificate.

• In internal/run/initkube.go, remove the non-empty Certificate assertion (and the associated test).
• In kubeconfig, add an if .Certificate to the else clause that adds a certificate-authority-data field.