Add support for host key certificates

[erbenson]

While blink supports SSH certificates on authentication keys. It appears to not support SSH certificates for host keys (known_hosts). With openssh you can place a CA in your known_hosts starting with @cert-authority <domain wildcard or *>

I tried editing the .ssh/known_hosts file in blink to add the @cert-authority but it was ignored.

Then any host with a certificate signed host key can login without having the specific host key in the known_hosts, and without the 'cache host key' prompt. All explained in detail at https://goteleport.com/blog/how-to-ssh-properly/