ipa-certupdate removes all CA certs from db before adding new ones
    
    This will allow for CA certificates to be dropped from the list
    of certificates. It also allows for the trust flags to be
    updated when an existing cert is dropped and re-added.
    
    https://pagure.io/freeipa/issue/8124
    
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>