Add improved handling for TLS certificates for static builds.

[Ferroin]

Summary

Our current static builds include a bundled copy of the CA certificates available in the build environment, and will automatically fall back to using those if they can’t find a usable set of CA certificates on the target system.

This works in a majority of cases, but it has a couple of issues:

• It doesn’t properly support the case of users who want to just use our bundled certificates unconditionally for some reason.
• It doesn’t actually test that the system certificates work to connect to Netdata infrastructure, and thus it’s entirely possible that we end up with an install we can’t claim because the users are refusing to follow security best practices and keep their CA certificate store up to date.

This PR works to remedy those issues. It adds additional logic to the installation code embedded in the static builds that handles the TLS certificates, adding support both for checking the usability of the selected certificates and for skipping the system certificates and just using the bundled ones. This functionality is controlled by two new options and associated environment variables:

• --certificates and NETDATA_CERT_MODE allow specifying the certificate handling mode. auto and system have the current behavior. check expands the current behavior by testing the detected system certificate store for usability by connecting to a well-known URL. bundled ignores any system certificates and unconditionally uses the bundled certificates. Defaults to auto if unspecified (thus preserving the existing behavior).
• --certificate-test-url and NETDATA_CERT_TEST_URL allow overriding the URL used by check mode for testing whether the system certificates are usable. Defaults to https://app.netdata.cloud if unspecified.

The options override any value specified by the environment variables.

Additionally, the kickstart script is updated to pass the claiming URL as the certificate test URL when performing a static build, and to make the certificate handling mode default to check for installs other than offline installs and auto mode for offline installs. The values passed by the kickstart script can still be overridden by using the --static-install-options option to add the --certificates or --certificate-test-url options as needed.

Test Plan

Testing requires manually installing static builds produced from this PR on a variety of systems with various values for the --certificates and --certificate-test-url options and observing how the symlink at /opt/netdata/etc/ssl is updated.

[Ferroin]

Flagging @netdata/agent as a reviewer for help with testing.