Due to bash max args limits, we should pass all node filenames and
base64-encoded tar data through stdin/stdout instead.

Fixes #832

Admin certs only go to etcd nodes
Only generate cert-data for nodes that need sync

Includes hooks for triggering calico, kubelet, and kube-apiserver restarts
if etcd certs changed.

Add tags to allow more granular tasks filtering.
Add generator script for MD formatted tags found.
Add docs for tags how-to.

Signed-off-by: Bogdan Dobrelya <bdobrelia@mirantis.com>