pkgbase: rework certctl package to only run rehash on the main package

Rework how ucl manifest are generated leveraging ucl features and flua

now the ucl generation is done via a lua script which uses libucl to
ingest the template and use variables as defined in its command line.

the template will include only if it exist a ucl file named after the
package name which will complement the template or overwrite what was
defined in the template if defined in this specific ucl file

this allows to overwrite license, but add script only to the packages
who actually needs them.

As a results the post install scripts are now only added to the right
package and not also added to the subpackages like -man or -dev

Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D44374

(cherry picked from commit f8e46fd61e055fcc767c2038d867f58c38e43ec3)