This adds a new stand-alone certificates controller for use on GKE. It
allows calling GKE to sign certificates instead of requiring the CA
private key locally.

It does not aim for 100% feature parity with kube-controller-manager
yet, so for instance, leader election support is omitted.