connect: allow any server to sign a CSR

Currently only the master can sign a CSR. This is because in the current implementation the serial number is derived from an incrementing index in the raft store so needs a write.

We considered that we could distribute this by using a random serial or per-server counter, but decided not to on the basis that 🔜 we plan to store issued cert metadata anyway to allow for a useful revocation UX and tracking rotation progress.

My esteemed colleague @schmichael pointed out that if we did use a random or per-server serial algorithm, then we could complete the actual crypto work which is non-trivial CPU load across all servers even if we then write metadata centrally. We could even do both in parallel provided we don't return the cert before we see the metadata got written.

While the crypto load distribution only matters for the built-in CA, the actual mechanisms in Consul to have a CA instance on each server would allow the proxying of signing requests to occur on all servers with external CAs too which is less of a win but still an improvement in reducing uneven leader load.

Start by tracing the current CSR signing entry point and how serial numbers are allocated from the Raft store. Compare the possible random or per-server serial approaches described here, including how issued-certificate metadata would be written and confirmed. Done means any server can handle signing without returning a certificate before required metadata is stored.

Written by the indexing model from the issue text.