Partialy fixes#268
On OIDC provisioner the certificate has two identities and
step-certificates does not create a user provisioner certificate.
This change avoid the panic and displays a proper message.
A fix in certificates is required to allow user provisioner
certificates with OIDC provisioners.
If the user re-runs the `ssh certificate` command, try to pull the
host-id out of a previous identity cert. This will make it less annoying
for someone who runs the command not knowing that it will clobber their
old host-id and result in a new host (requireing them to also
re-register).
Apparently some images don't properly handle the machine-id and it ends
up not being unique. By default play it safe and generate our own UUID.
Deriving a UUID from `/etc/machine-id` is still supported. To trigger
that behavior, pass 'machine' as the `--host-id` flag.
The short of it is that blake2b is designed to be a MAC. So let's use it
instead of worrying about whether we've used hmac|sha256 with a big
enough key, etc.
Add error details and inform the user if the try to pass `--host-id` but
have not specified `--host`. Also add a hint about what the potental
problem could be and a resolution option when we can't derive a host-id
from '/etc/machine-id'.
Alternatively, allow the user to specify their own UUID. Adding an ID
derived from the machine ID allows us to authorize hosts to access their
own resources by ID. The machine-id is not supposed to be sent around as
a raw UUID. So we HMAC it with an application "secret" and use the first
sixteen bytes of the resulting sha256 sum to as the entropy source when
generating a new "random" UUIDv4.
Allow users to specify the endpoint that `step ssh config --team` uses
to pull initial configuration. If no endpoint is specified, default to
https://api.smallstep.com/v1/teams/<name>/cas/default
If the user-specified endpoint contains any "<>" sequences, replace them
with the team name.
