Include multiple cluster CAs in trust stores

[johngmyers]

This does a few things:

• Puts the cluster CA trust store into nodeup.Config.
  • Staging new CAs will cause rolling update to replace all nodes.
  • Worker nodes eventually won't need read access to the cert store.
• Includes all cluster CA certs in the trust stores for most components.
  • AWS IAM Authenticator is yet to be converted.
• Starts refactoring users of private keys to the new keypair-based interfaces.
  • Bootstrap kubeconfig generation code to use the new FindPrimaryKeypair interface.
  • Make the BuildCertificatePairTask used by kops-controller use consistent file naming and prepare it to subsume BuildCertificateTask and BuildPrivateKeyTask.
• Removes some unused methods in the CAStore interface.

[johngmyers]

/assign @olemarkus

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: olemarkus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [olemarkus]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment