On distributed runners, identities are not issued

This makes sense, we wired the cert issuer part directly to the sandbox controller, which is only true in the case of the primary node.

The fix is to expose the ability to mint identities to an RPC that the runners can call on the coordinator.