ca: only return the leaf cert from Sign in vault provider
ca: only return the leaf cert from Sign in vault provider

The interface is documented as 'Sign will only return the leaf', and the other providers
only return the leaf. It seems like this was added during the initial implementation, so
is likely just something we missed. It doesn't break anything , but it does cause confusing cert chains
in the API response which could break something in the future.

hashicorp/consul,hashicorp/consul,hashicorp/consul,hashicorp/consul