clientupdate/distsign: use distinct PEM types for root/signing keys (#9045)

To make key management less error-prone, use different PEM block types
for root and signing keys. As a result, separate out most of the Go code
between root/signing keys too.

Updates #8760

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>

clientupdate/distsign/roots/to-be-replaced.pub

@@ -1,3 +1,3 @@
------BEGIN PUBLIC KEY-----
-JNBgo4EFQ+DpRcESM2xU19xQWGffvLcmxtBMT4I+Qo0=
------END PUBLIC KEY-----
+-----BEGIN ROOT PUBLIC KEY-----
+xFykOJAkOlBoMOXA4UKYtaSGYsOY8r1+0wJzQE5mzUo=
+-----END ROOT PUBLIC KEY-----