Implement self-signing in 'openssl ca'. This makes it easier to have

the CA certificate part of the CA database, and combined with
'unique_subject=no', it should make operations like CA certificate
roll-over easier.