Change group ownership of CRL publish directory
    
    Spec file modified so that /var/lib/ipa/pki-ca/publish/ is no
    longer owned by created with package installation. The directory
    is rather created/removed with the CA instance itself.
    
    This ensures proper creation/removeal, group ownership
    and SELinux context.
    
    https://fedorahosted.org/freeipa/ticket/3727