Serve print-cert on the info API, with -address and preferring our v2 certificate

A program that verifies certificates against its own CAs, as
nebula-auth-request does, needs the certificate itself rather than the
parsed identity, and it asked the ssh debug server for it. The info API
now serves print-cert, so it can ask there instead.

- print-cert declares Identity: it reads a certificate from the hostmap or our own, and nothing operational
- -address names the vpn addr, with a port accepted and stripped and 4in6 unmapped, as identity takes it; the operand stays, and giving both is refused
- an address of our own answers with our own certificate, and a tunnel without one is not found, a 404 on the API
- with no address the certificate is the one whoami reports, the v2 when both versions are loaded, not the one handshakes start with
- GET /v1/print-cert?address=<addr>&raw=true answers {"pem": ...}; example config, CHANGELOG, surface test, goldens and an e2e check

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

testdata/ssh_commands.golden

@@ -100,8 +100,10 @@ log-level
     	pretty prints json, assumes -json
 print-cert
   short: Prints the current certificate being used or the certificate for the provided vpn addr
-  help: 
+  help: The vpn addr is an operand or -address, which may carry a port so a connection's remote address can be passed through as is. For a peer it is the certificate nebula verified when the tunnel came up; with no address it is this node's own, the v2 certificate when both versions are loaded. -raw prints the PEM.
   flags:
+  -address string
+    	The vpn addr to look up, optionally with a port
   -raw
     	prints the PEM encoded certificate; with -json, an object holding it
   -json