Specifically they should both add the subject CN to the set of
subjectAltNames. Also add a small test script to verify that signing
works using the command-line tool.

In 'x509ca check', add an option to pass the CA certificate so that
the tool can verify that it actually signed the service
certificate (used to detect CA changes).

Split sign

See merge request !1

# Conflicts:
#   .gitlab-ci.yml

Fix exit status when --check is used, fix certificate metadata comparison.

With the --use-exit-status option x509ca will now exit with status 10
when the certificates have been modified successfully (unless --check
is specified, which takes precedence).

Introduces improvements such as:
- better command-line interface using init/sign commands
- all commands are idempotent
- support dry-run --check option for automation