api: add GET /intermediate.crt for AIA caIssuers

[Yannik]

Name of feature:

api: add GET /intermediate.crt for AIA caIssuers

Pain or issue this feature alleviates:

step-ca currently exposes /intermediates.pem, but that endpoint is not a good
fit for a certificate's AIA caIssuers URL:

• It serves PEM, while RFC 5280 Section 4.2.2.1 says an HTTP
  id-ad-caIssuers accessLocation must point to either a single
  DER-encoded certificate as specified by RFC 2585 Section 3, or a certs-only
  CMS bundle. For a single-certificate response, RFC 5280 recommends
  Content-Type: application/pkix-cert, the media type registered by RFC 2585
  Section 4.1.
• It is only registered on the HTTPS mux. For TLS subscriber certificates,
  CA/Browser Forum Baseline Requirements Section 7.1.2.7.7 describe
  id-ad-caIssuers as an HTTP URL of the issuing CA certificate, so clients
  can fetch the issuer before they can validate the CA's TLS certificate.

Why is this important to the project (if not answered above):

This makes step-ca able to serve the issuing intermediate certificate in the
format and scheme expected by common AIA caIssuers clients, without requiring
extra infrastructure around step-ca.

Is there documentation on how to use this feature? If so, where?

No standalone documentation is added in this PR. The endpoint can be used
by setting a certificate template's issuingCertificateURL to the HTTP
endpoint:

{
  "issuingCertificateURL": ["http://ca.example.com/intermediate.crt"]
}

In what environments or workflows is this feature supported?

When step-ca is an intermediate CA.

In what environments or workflows is this feature explicitly NOT supported (if any)?

If step-ca is a Root CA (GetIntermediateCertificates() returns no certificates)

Supporting links/other PRs/issues:

• RFC 5280 Section 4.2.2.1: Authority Information Access
• RFC 2585 Sections 3 and 4.1: Internet X.509 Public Key Infrastructure
  Operational Protocols: FTP and HTTP
• CA/Browser Forum Baseline Requirements Section 7.1.2.7.7:
  id-ad-caIssuers for TLS subscriber certificates
• Mozilla bug 1637093: PEM served via AIA caIssuers flagged as a compliance
  issue