Serve print-cert on the info API, with -address and preferring our v2 certificate

A program that verifies certificates against its own CAs, as
nebula-auth-request does, needs the certificate itself rather than the
parsed identity, and it asked the ssh debug server for it. The info API
now serves print-cert, so it can ask there instead.

- print-cert declares Identity: it reads a certificate from the hostmap or our own, and nothing operational
- -address names the vpn addr, with a port accepted and stripped and 4in6 unmapped, as identity takes it; the operand stays, and giving both is refused
- an address of our own answers with our own certificate, and a tunnel without one is not found, a 404 on the API
- with no address the certificate is the one whoami reports, the v2 when both versions are loaded, not the one handshakes start with
- GET /v1/print-cert?address=<addr>&raw=true answers {"pem": ...}; example config, CHANGELOG, surface test, goldens and an e2e check

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

examples/config.yml

@@ -262,6 +262,9 @@ punchy:
   #                                               is ignored. 404 when no tunnel is
   #                                               up, 400 when no address is given.
   #   GET /v1/whoami                              this node's identity
+  #   GET /v1/print-cert?address=<vpn addr>[:port]&raw=true
+  #                                               the certificate for the specified
+  #                                               address, as {"pem": ...}.
   #   GET /v1                                     describes what is served
   #
   # NB: unless a connection arrived on the nebula interface, there's no guarantee