Implement functionality to construct signed Ed25519 certs.

This is behind a feature flag, since it isn't needed for pure clients: only onion services and relays need this.

I've named the object that constructs these certs Ed25519CertConstructor because it doesn't follow the builder pattern exactly: mainly because you can't get an Ed25519Cert out of it. That part is necessary because we require that an Ed25519Cert should only exist if the certificate was found to be well-signed with the right public key.

Closes #511 (closed).