Doc: Distributed Monitoring: add section "External CA/PKI"

[Al2Klimov]

The following already works:

• Custom key sizes, e.g. 2048 bits
• Custom key types, e.g. ECC
• Multiple trusted root CAs in /var/lib/icinga2/certs/ca.crt
• Different root CAs per cluster subtree, as long as each node trusts the issuers of the certificates of all nodes it's directly connected to
• Any number of intermediate CAs

refs #9798 refs #7323

[Al2Klimov]

FYI @bobapple @widhalmt @tbauriedel