smart-card advises: add steps to store smart card signing CA cert
    
    On master, upload the CA certificate to IPA LDAP and NSS databases. On
    both master and client run ipa-certupdate to update client-side CA
    certificate bundles used as PKINIT anchors.
    
    https://pagure.io/freeipa/issue/7036
    
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>