certificate

In all of our current uses of os.umask or filesystem.umask, we always temporarily set it to a different value and then restore it using a try/finally block. I expect this pattern to continue.

Because of that, why don't we create a simple function in certbot.util that can be used as a context manager to set umask to a value and restore it to its previous value when exiting the with blo

Describe the bug:

This will allow users to set up API mgmt for provisioners, and unblock users in environments where the ca.json is not easily accessible.

The --enable-admin flag would create the first provisioner and admin (this code already exists, just behind a boolean).
The --acme flag would create an ACME provisioner.

Related: smallstep/certificates#737

Beyonce said it best. If you like it then you shoulda put a test on it. Scenarios I like:

• Cert is created with right DN
• Cert is stored to X509Store after creation
• Cert request is not resubmitted
• Handles failures gracefully
• HTTP challenge/response works as expected
• Certificate renewal when cert is about to expiration