client install: fix client PKINIT configuration
    
    Set `pkinit_anchors` in `krb5.conf` to a CA certificate bundle of CAs
    trusted to issue KDC certificates rather than `/etc/ipa/ca.crt`.
    
    Set `pkinit_pool` in `krb5.conf` to a CA certificate bundle of all CAs
    known to IPA.
    
    Make sure both bundles are exported in all installation code paths.
    
    https://pagure.io/freeipa/issue/6831
    
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>