certs: move scripts/extract-cert to certs/