[FEATURE REQUEST] x509_v2 SSH wrappers

[lkubb]

Is your feature request related to a problem? Please describe.
I would like to manage X.509 certificates with Salt-SSH while still using remote signing via peer publishing.

Describe the solution you'd like
The wanted solution is twofold:

1. Add SSH wrappers for x509_v2.create_certificate and x509_v2.get_signing_policy (when ca_server is specified).
2. Add another wrapper function that emulates x509_v2.certificate_managed during rendering (where we still have access to the event bus) and that can be called like a Jinja macro (returning the necessary highstate structure only).

Describe alternatives you've considered
Nothing really. Signing locally on the minion is out of the question for security reasons and the x509_v2.certificate_managed state currently does not work with different backends (one could imagine it e.g. pulling certificates from Vault or somewhere else instead).

Additional context
This has been asked for before, but what the author assumed would add the feature is only a necessary prerequisite: #40943

Point 2. is a workaround for state modules being run on the target without a communication channel back to the master. I have already written the implementation and verified that it works reasonably well. Essentially, it

• does the changes check on the salt-ssh master
• creates a new private key at a temporary location if key rotation is wanted
• pulls the corresponding public key onto the master (not the private key)
• uses the publish wrapper to get the public key signed
• returns a highstate structure that will a) move the temporary private key to the correct location, 2) write the certificate and 3) report the state result like usual (it is passed from the wrapper as well) (opts["test"] should be passed in to avoid unnecessary issuance, but in the worst case the signed certificate and private key will be discarded by the target)

When using the default jinja|yaml renderer, it should be used like:

{{ salt["x509.certificate_managed_wrapper"](...) | yaml(false) }}
# or
{{ salt["x509.certificate_managed_wrapper"](...) | json }}

But it should work with any renderer as long as it can call wrappers.