A few minor cleanups to hci facades

* Bury the grpc service construction inside the facade service
* no need to keep the rootcanal config around, pass it along without
cloning

Bug: 171749953
Tag: #gd-refactor
Test: gd/cert/run --host
Change-Id: If7820cecbcd899b7cab5c72678da986559bbcdd7