Make DB Direct certificates server_ca configurable

[jgoizueta]

So far, in development, the server_ca certificate has been fetch from the CA used to sign client certificates, but in production we need to control what should be in it or if it should be disabled (e.g. for server certificates signed by CA for which all systems include their root certificates).

So I've added a new configuration parameter dbdirect.certificates.server_ca to control this.

• If it's not defined we preserve the current behaviour, which can also be selecte withe the special client_ca value (for convenience of chef-controlled configurations)
• The special value disabled prevents inclusion of server_ca with client certificates and omits also references to it in the README.
• Otherwise it should contain a URL accessible to download the server_ca file.

[gonzaloriestra]

What about some tests?

[jgoizueta]

Regarding the tests: unfortunately, CertificateManager has no CI tests at all: it relies heavily on AWS services. Given the current workload I'd rather not get into this; I feel confident with the local tests I've performed.