certdb: Move chdir into subprocess call
    
    According to a comment, certutil may create files in the current working
    directory. Rather than changing the cwd of the current process,
    FreeIPA's certutil wrapper now changes cwd for the subprocess only.
    
    See: https://pagure.io/freeipa/issue/7416
    Signed-off-by: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>