ESC1 certificate template abuse for domain admin

A template that allows enrollee-supplied subject and has a client-auth EKU lets a low-priv user request a cert as any account.