Allow locally specified certificates to be added to the trusted CA bundle.
Allow locally specified certificates to be added to the trusted CA bundle.

It goes in $TB/etc/extracerts.bundle.  Right now, there's no way to
similarly maintain local CRLs, CA blacklists (certificates _not_ to allow
from the CH), or to refuse certificates from the CH by default, but we
can find a way to do those things if there's any need.

nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome,nmc-probe/emulab-nome