sign: allow to restrict usage of the signed certificate

[tux21b]

Call "etcd-ca sign --server=false myclient1" to generate a client-only certificate. Similarly, set --client=false for certificates that are only valid for server authentication.