MFC r360833, r360882, r361149: installworld certctl nop

The last one reverts the other two, but here are the commit messages:

r360833:
installworld: attempt a certctl rehash at the tail end

This can be run as root or normal user with no problem; if they hadn't
twisted the WITHOUT_CAROOT knob, we'll attempt to use the host certctl to
rehash the DESTDIR. This would allow one to build systems WITHOUT_OPENSSL +
WITH_CAROOT with a populated /etc/ssl that they can then use with an
appropriate *ssl from somewhere else.

Cross-builds are fine because this will always use the host certctl, or just
nag if it's missing and it wasn't a WITHOUT_CAROOT build.

r360882:
buildworld: add back in missing semicolon

if foo; then blah else blah; fi has a drastically different meaning than
if foo; then blah; else blah; fi. Fix it.

r361149:
Revert r360833, r360882: certctl rehash in installworld

This was solving the correct-ish problem in the wrong place. Noted by
brooks; while he didn't request a prompt revert, doing so now will
facilitate proper testing for the revised version of this.