provide the capability for system admins to specify host/ssh cert signing key per domain

[havetisyan]

currently the logic to decide what key to use for signing x.509 and ssh host certificates lies with the signer interface. The request is to have the capability on per-domain basis where the system administrator can specify the key id used for signing. The signer interface will get this attribute from ZTS (it may decide not to honor it) but it allows the system admin the flexibility to use different private keys for a set of domains, if necessary.

The feature will require 2 new attributes on per-domain basis:

• x509CertSignerKeyId
• sshCertSignerKeyId

When a new subdomain is created, it must automatically inherit the value set at the parent domain level if one is configured.