Automatic merge from submit-queue (batch tested with PRs 43866, 42748)

hack/cluster: download cfssl if not present

hack/local-up-cluster.sh uses cfssl to generate certificates and
will exit it cfssl is not already installed.  But other cluster-up
mechanisms (GCE) that generate certs just download cfssl if not
present.  Make local-up-cluster.sh do that too so users don't have
to bother installing it from somewhere.