This turns out to be required to produce correct metalog output.
Fix metalog output to be relative to DESTDIR.
Rework the tests so they're agnostic to DISTBASE and add a testcase
that verifies (part of) the metalog, and account for a recent change
in openssl storeutl.
Fixes: 81d8827ad875 ("certctl: Reimplement in C")