ESC8: coerce a DC and relay to AD CS web enrollment

HTTP certificate enrollment plus machine coercion turns any domain foothold into a DC certificate and DCSync.