Consider synchronizing hostcrl with cacrl during startup

...the same way we synchronize the hostcacert with the cacert.

This came about because some things – like the installer – are (correctly) using the hostcrl, but the Server never updates it after it creates it the first time. While our story for CRL support is already a bit of a manual one, this automated step seems harmless and could be worthwhile for users considering the development effort it would take.

Some ways we could implement this synchronization are:

• Another part of the existing CA/initialize-master-ssl! or CA/retrieve-ca-cert!
• A new CA protocol method (e.g. retrieve-ca-crl! or something)
• Another part of the master service initialization