caroot: add a primitive script to re-stamp certs

The tooling in main isn't stamping output with $FreeBSD$ strings going
forward, so we need to remember to do that in this branch with each
update. Add a stupid simple script that we can just run every time we
MFC an update without having to put much thought into it.

Direct commit to stable/12 because we don't need this in stable/13 or
stable/14.