Add ability for ESC8 to issue cert on DC template automagically

[bwatters-r7]

If an attacker uses petitpotam and cooerces the machine account to try to log into the relay, we should try and identify that specific login and instead of using the standard machine template, we should issue the DC template.
There are a few ways we can do this- we could try and issue the cert with the DC template and then fall back to the machine template if we fail, or possibly, we just need to check to see if we have access to the DC template, and then issue the cert only if we have access to the template.