Allow users to manually trust the server certificate on infra login

[dnephin]

Is your feature request related to a problem? Please describe.

Current infra login requires --skip-tls-verify, or the user must accept the prompt for "The authenticity of the host can't be established.".

Similar to how ssh works when you connect to a new host, we should be able to prompt the user to trust the certificate used by the server.

Describe the solution you'd like

When the server starts we should print the certificate to the logs and/or to a file on the ephemeral filesystem. This will allow the admin to view the generated certificate using a kubectl command. I think we may already do this in some cases (~/.infra/cache/ seems to have certs).

In the CLI we would need to make 2 changes:

1. When we get a x509.UnknownAuthorityError, print the details of the certificate (they are available as x509.UnknownAuthorityError.Certificate). Then prompt the user to see if they would like the trust the certificate. We can also suggest that they either ask their admin to confirm the details, or if they are an admin they can use kubectl exec ... to print the expected cert. Once trusted we can save the certificate to the local filesystem.
2. When we construct the API client in the CLI we can use a tls.Config that populates the RootCAs from the certs saved on disk. That way future calls to the API will continue to trust the certificate that was previously trusted by that user.

[jmorganca]

Related: #296