[RFE] add an action to set up an internal root ca to be used for pre-intermediate-CSR testing iterations

During on-site deployments there are cases where several deployment iterations are required.

As vault is normally a part of a single model along with OpenStack services, we need to take it down along with everything else which leads to loss of private keys and intermediate CA certs.

In order to do several test iterations we need to either work with a dummy easyrsa-based CA and sign CSRs from vault or, alternatively, use vault as a root CA.

https://www.vaultproject.io/api/secret/pki/index.html#generate-root

This is a feature request to implement an action to generate a root CA and logic around it for switching to an intermediate ca at a later point and regenerating already issued certificates.