cli: Use unique subjects in `cockroach cert create-ca`

**Is your feature request related to a problem? Please describe.**

`cockroach cert create-ca` uses a hard-coded subject of `O=Cockroach,CN=Cockroach CA` for all CA certificates. If the `ca.crt` file contains the wrong CA certificate but the subject is correct, the Go crypto libraries produce a cryptic error message `crypto/rsa: verification error`. If the subjects didn't match, we'd get a (slightly) better error message of `x509: certificate signed by unknown authority`.

**Describe the solution you'd like**

All CA certificates generated by `cockroach cert` commands should have unique subjects, probably by adding a `UID` field to the subject containing a UUID.

**Describe alternatives you've considered**
It would also be nice to allow and encourage people to set their own subject instead of just using `O=Cockroach,CN=Cockroach CA,UID=234543...` all the time.

Jira issue: CRDB-37173