AWS::CertificateManager::Certificate - CertificateAuthorityArn

## AWS::CertificateManager::Certificate-CertificateAuthorityArn (New Property)

## 2. Scope of request
Add Private CA certificate support to AWS::CertificateManager::Certificate (for use with LoadBalancing/Cloudfront/APIGateway)

Alternatively create a new resource AWS::CertificateManager::PrivateCertificate that supports the subset of ACM.RequestCertificate API relating to private certs only.

## 3. Expected behavior
Calls ACM RequestCertificate with the new property, generating a private cert, and returning the ACM ARN of that cert.

Currently required properties related to Public Certificates become optional.

## 5. Helpful Links
https://docs.aws.amazon.com/acm/latest/APIReference/API_RequestCertificate.html#ACM-RequestCertificate-request-CertificateAuthorityArn

## 6. Category - Security

Start with the linked ACM RequestCertificate API documentation and the existing AWS::CertificateManager::Certificate coverage. Compare the requested CertificateAuthorityArn property with the private-certificate API requirements and decide whether to extend the existing resource or add AWS::CertificateManager::PrivateCertificate. Done means private certificates can be requested and the resulting ACM ARN is returned, with public-certificate-only properties no longer required.

Written by the indexing model from the issue text.