Freeze break request: add vpn ccd file and vpn role to retrace
    
    We need retrace03 on the vpn at least for now, or else 2fa won't work.
    At some point when fasClient is gone we may be able to drop this
    when we switch to sssd or something else.
    
    Signed-off-by: Kevin Fenzi <kevin@scrye.com>