certctl: Split certificate bundles before processing.

This allows 'certctl rehash' to do the right thing when ca_root_nss is
installed, instead of linking the entire bundle to the hash of the
first certificate it contains.

MFC after: 3 days
Reviewed by: allanjude
Differential Revision: https://reviews.freebsd.org/D42087

(cherry picked from commit a401c8cb26b22688087ad7c5ee527718459df15a)

certctl: Fix recent regressions.

• If an untrusted certificate is also found in the list of trusted certificate, issue a warning and skip it, but don't fail.
• Split on -+BEGIN CERTIFICATE-+ instead of "Certificate:" since that's what we're really looking for.

Also fix a long-standing bug: .crl files are not certificates, so we
should not include them when searching for certificates.

Reported by: madpilot, netchild, tijl
Reviewed by: netchild, allanjude
Differential Revision: https://reviews.freebsd.org/D42276

(cherry picked from commit 87945a082980260b52507ad5bfb3a0ce773a80da)

certctl: Convert line endings before inspecting files.

This ensures that certificate files or bundles with DOS or Mac line
endings are recognized as such and handled identically to those with
Unix line endings.

PR: 274952
Reviewed by: allanjude
Differential Revision: https://reviews.freebsd.org/D42490

(cherry picked from commit f7d16a627efa8ba610eb9b8a12dd67b6cdbb2542)

certctl: Revert to symlinks.

Unfortunately tar will not be able to extract base.txz to a system where
/etc and /usr are not on the same filesystem if the certificates are
hard links.

PR: 277828
Reviewed by: mp
Differential Revision: https://reviews.freebsd.org/D44496

(cherry picked from commit 3fed4f0db53a66a0135bea5c491431eb3348cf51)