Features:
* Support HSM based factory root CA for "el2go config-device-gateway" and "est authorize".
* Support TLS certificate rotation for device gateway and OSTree server using "keys ca rotate-tls".
* Support adding more than 1 online or local device CA using "keys ca add-device-ca".
Changes:
* Check if target directory contains update data before generating offline update using "targets offline-update".
Added an option to allow or deny overwriting update data if it is present (denied by default).
* Don't show "last connection" field for El2Go devices list using "el2go devices".
* Support Subject Key ID and Authority Key ID X.509 extensions in "keys ca show".
Fixes:
* Clean tag duplicates when re-tagging using "targets tag".
* Deny empty positional arguments like "" or '' for all commands.
Such arguments were passing validation and could lead to undefined behavior in some commands.
* Do not overwrite the online device CA in PKI directory when running "el2go config-device-gateway".
An El2Go device CA needs not be written to disk at all; it is send to the cloud API instead.
* Require the "--pki-dir" argument in "el2go config-device-gateway".
It defaulted to the current directory in the past, that would usually fail when running the command.
Notes:
* In v0.37 the "el2go config-device-gateway" and "est authorize" were still using Bash scripts to generate certificates.
That would not work for new customers, and did not support the HSM based factory root CA for old customers.
Those two commands were modified to use the same Golang based PKI as all "keys ca" subcommands in v0.38.
