CMP app: fix combination of -certout and -chainout with equal filename arg

[DDvO]

When using the same filename argument with the cmp app options -certout and -chainout,
the file so far contains just the chain - the new cert is lost because it happens to get overwritten.
This is fixed here in a useful way without touching the API, namely by prepending the cert to its chain.
On this occasion also the documentation is improved.

Checklist

• documentation is added or updated
• tests are added or updated

[t8m]

Would it be hard to add a test?

[DDvO]

Would it be hard to add a test?

I had already started thinking about that,
and meanwhile have added a test each on successfully producing and using the combined output file.