Make authority root and intermediate certificates editable.

[kevgliss]

Today issuer plugins control their intermediate and root certificates, however it may make more sense, that they are either chosen or uploaded on authority creation.

This would allow you to switch out a given intermediate or root, then all new certificates would be tied to that chain.

Each authority should have a root and intermediate certificate. An EE certificate would then be tied to its issuing authority and whatever root or intermediate is currently associated with it.

One possible issue would be external destinations that do not have this flexibility, in these instances the certificate would have to be re-pushed and then re-deployed in order to reflect the change in chain.