certctl: Introduce a new -d <distbase> option

This will be used by Makefile.inc1 to fix -DNO_ROOT distributeworld,
which needs to split out DESTDIR from DISTBASE so the METALOG file
includes the base/ prefix.

Reviewed by: kevans
Obtained from: CheriBSD
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D35808

(cherry picked from commit 232cf6be4bc493412f1c8b80a4cdc00fe53075c6)