certctl(8): switch to install(1) to fix DESTDIR support

"Oops" - ln(1) is fine and dandy, but when you're using DESTDIR...it's not-
the path will almost certainly be invalid once the root you've just
installed to is relocated, perhaps to /.

Switch to install(1) using -l rs to calculate the relative symlink between
the two, which should work just fine in all cases.

MFC after: 1 week