Add step certificate unbundle subcommand - #1685

Adds step certificate unbundle, the inverse of step certificate bundle, so you can pull the leaf or the intermediate chain back out of a bundle. Closes #1437.

It reads a bundle (file or - for STDIN), treats the first cert as the leaf and everything after it as the intermediate chain, and writes the part you ask for. --leaf or --intermediate picks which; without --out it goes to STDOUT, with --out <file> it's written to that file.

step certificate unbundle --leaf bundle.crt
step certificate unbundle --intermediate bundle.crt
step certificate unbundle --leaf --out leaf.crt bundle.crt
step certificate unbundle --intermediate --out intermediate.crt bundle.crt

I went with the --leaf/--intermediate + --out flags from the issue rather than maraino's positional-arg variant, since hslatman leaned that way in the thread ("less room for guessing which file comes in which order"). Requiring exactly one of the two selectors keeps it unambiguous. Happy to switch to the positional form or add a "write both at once" mode if you'd rather.

--intermediate on a bundle that only has a leaf errors out instead of writing an empty file.

Tests in unbundle_test.go cover splitting a 2-cert bundle (both directions), a single-cert input, bad input, and the flag-validation paths. go build ./... and go test ./command/certificate/... both pass.