tls: largely rewrite cockpit-certificate-ensure
tls: largely rewrite cockpit-certificate-ensure

Rework the logic in cockpit-certificate-ensure:

  - call out to cockpit-certificate-helper using posix_spawn() instead
    of execl() so that we regain control after the self-signed
    certificate has been created

  - attempt to actually parse the certificates that we find so that we
    can catch format errors

  - now that we parse the certificates for ourselves, we can do our own
    expiry check

  - we can also do the splitting of combined certificates ourselves.
    Borrow the logic for that from cockpitwebcertificate.c, but rewrite
    the algorithm to use a loop and modify the already-loaded
    certificate in-place.  If we find that combined certificates are in
    use, issue a warning about them being deprecated.

The main purpose here, however, is to lay the groundwork for the
following commit.

martinpitt/cockpit,cockpit-project/cockpit,martinpitt/cockpit,martinpitt/cockpit,cockpit-project/cockpit,cockpit-project/cockpit,cockpit-project/cockpit,mvollmer/cockpit,mvollmer/cockpit,cockpit-project/cockpit,mvollmer/cockpit,mvollmer/cockpit,martinpitt/cockpit,mvollmer/cockpit,martinpitt/cockpit