add two new options to "certmaster-ca"

-list-signed shows a list of certs the certmaster has already signed

--list-cert-hashes returns the list of signed certs in the CN-hash format that
the acls files expects. Should make it a little easier to use the acls.

Both options take optional hostnames or hostname globs