make it more convenient to add components to an existing certificate

Right now, we have a convenient interface for creating certificates. It's not that flexible (e.g., you can't specify whether a User ID should have the primary user id bit set), but it's flexible enough to cover the most common cases.

Unfortunately, we don't have a convenient way to add User IDs, etc. to existing certificates. Add this and rewrite the CertBuilder to use it.