freebsd-update: rehash certs

With the inclusion of caroot bits, we'll need to also rehash on update as we
do in mergemaster/etcupdate.

If certctl's installed on the system, just unconditionally rehash. This
isn't an expensive operation, and we can refine it to compare
INDEX-{OLD,NEW} later if we really want to.

Reviewed by: emaste, allanjude
MFC after: 3 days
Differential Revision: https://reviews.freebsd.org/D21805