Autocert: support multiple roots feature

[chris-lee-lb]

What would you like to be added

Need a way to also keep sync the latest root bundles from step-ca server. A simple idea is that maybe we can use step ca new --exec to execute step ca roots.

Why this is needed

To support step-ca support multiple roots feature.