Potentionally duplicate local cert dirs

[conorsch]

When creating and maintaining persistent PKI, the role creates two very similar local dirs:

• certs/
• newcerts/

These values are also duplicated in the openssl.cnf, via the certs and new_certs_dir options. We should dig into the relationship here and see if we actually need both dirs. If we do, some documentation is in order to explain the distinction succinctly.