Fix cert usages and Zookeeper namespace

The certificates need the client auth usage in order for ZK to
accept them when presented by Zuul/Nodepool.

The zookeeper cluster also needs to be in the zookeeper namespace.

Finally, we need to run the certs.yaml file we recently added.

Change-Id: I9423ec7ff68f6e3f22cdb50334641314bcd2782b