Prefer bootstrapped tools when running certctl.sh

[arichardson]

Summary

Otherwise we get lots of warnings when building on Linux/macOS during
installworld:
Scanning /local/scratch/alr48/cheri/output/freebsd-x86/usr/share/certs/blacklisted for certificates...
install: invalid option -- 'U'
Try 'install --help' for more information.
install: invalid option -- 'U'
....

Maybe certctl should run with set -e?

Test Plan

no more warnings emitted, didn't check if it does the right thing.