certctl: Add an option to copy files.

This is slower than linking but is the only method that works for all
cases, including running certctl from outside a jail that does not
contain the raw certificate data.

While here, fix a bug that occurs in unprivileged mode if DESTDIR
is unset or the root directory.

MFC after: 1 week
Reviewed by: dfr
Differential Revision: https://reviews.freebsd.org/D51373