certctl: Fix recent regressions.

• If an untrusted certificate is also found in the list of trusted certificate, issue a warning and skip it, but don't fail.
• Split on -+BEGIN CERTIFICATE-+ instead of "Certificate:" since that's what we're really looking for.

Also fix a long-standing bug: .crl files are not certificates, so we
should not include them when searching for certificates.

Reported by: madpilot, netchild, tijl
Reviewed by: netchild, allanjude
Differential Revision: https://reviews.freebsd.org/D42276