support certgen in rama-cli

[GlenDC]

• generate server / client certs
• fully self-signed, or by passing it a root (CA)
• via cli opts and asking input where missing

to be used as rama certgen ... e.g. rama certgen --out /tmp/localhost.crt --key-out /tmp/localhost.key

To make this work a public API will also need to be made available in rama-tls, to expose generating certs in a friendly manner, as that's currently only accessible by those services.