/etc/rc.d/cerctl_init: New script for certctl rehash in live images.

This is very limited -- it does not supplant postinstall to rehash
certificates on upgrade; it only runs certctl rehash if
/etc/openssl/certs is an empty directory, as you get in live images
not created with sysinst.

We could also have a more general-purpose way to run postinstall(8)
on first boot of an image, but that has a lot more moving parts to
think about, so let's start with this limited-scope low-risk
approach.

PR install/57629

XXX pullup-10

Disable kernfs on live images -- it is not required.

Fix fallout from mkimage rev 1.76.

For mkimage:

- Update "size" if auto-calculated.
- Use "dd bs=1" instead of non-portable "head -c".
- Some style nits.

For MD make_label() functions:

- Stop using "newsize" as image size in MB, use "size" instead.

Create an "octeon.img.gz" bootable image for evbmips64-eb release builds.