MFC r361397, r361683: certctl(8) unprivileged mode

r361397:
Add an unprivileged mode where calls to install are passed appropriate
flags. For ease of integration, use the same flags as install:

-U unprivileged mode
-D <destdir> Specify DESTDIR (overrides the environment)
-M <metalog> Full path to METALOG file

r361683:
certctl: fix test syntax

test doesn't understand &&, but it does understand -a.