Install certmanager and sshsignhost from RPM (#524)

certmanager and sshsignhost are now Go binaries released as RPMs, and their packaged paths collide with the venv install these helper classes manage.

- Drop the pyvenv, pip, rendered script and /usr/local/bin symlink resources
- Delete the now-unused Python script templates
- Keep rendering /opt/<tool>/config.yaml, unchanged ownership and mode
- Nest certmanager's output_path under vault:, where the binary reads it
- Drop output_path from sshsignhost's config; the binary has no such key
- Pin certmanager to 0.2.0 and sshsignhost to 0.1.0 on the puppet master role
- Point sshsignhost at the sshca mount and signhost role, documented in doc/vault

Reviewed-on: #524
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/roles/infra/puppet/master.yaml

@@ -32,6 +32,10 @@ profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-
 profiles::packages::include:
   encapic:
     ensure: '0.2.0'
+  certmanager:
+    ensure: '0.2.0'
+  sshsignhost:
+    ensure: '0.1.0'
 
 profiles::puppet::encapic::encapi_url: https://encapi.k8s.syd1.au.unkin.net
 profiles::puppet::server::external_nodes: '/usr/bin/encapic-enc'
@@ -57,10 +61,9 @@ profiles::helpers::certmanager::vault_config:
 
 profiles::helpers::sshsignhost::vault_config:
   addr: 'https://vault.service.consul:8200'
-  mount_point: 'ssh-host-signer'
+  mount_point: 'sshca'
   approle_path: 'approle'
-  role_name: 'hostrole'
-  output_path: '/tmp/sshsignhost'
+  role_name: 'signhost'
   role_id: "%{lookup('sshsignhost::role_id')}"
 
 profiles::puppet::server::agent_server: 'puppet.query.consul'