Fix ipa-replica-install when upgrade from ca-less to ca-full
    
    When ipa-replica-prepare is run on a master upgraded from CA-less to
    CA-full, it creates the replica file with a copy of the local /etc/ipa/ca.crt.
    This causes issues if this file hasn't been updated with ipa-certupdate,
    as it contains the external CA that signed http/ldap certs, but not
    the newly installed IPA CA.
    As a consequence, ipa-replica-install fails with "Could not find a CA cert".
    
    The fix consists in retrieving the CA certificates from LDAP instead of
    the local /etc/ipa/ca.crt.
    
    https://fedorahosted.org/freeipa/ticket/6375
    
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
    Reviewed-By: Tomas Krizek <tkrizek@redhat.com>