Always copy cert generation scripts to first etcd (#11612)

If we don't, existing installation would not pick up fix to that script,
such as dc33a197.