Backport PR 988 to ipa-4-5 Fix Certificate renewal (with ext ca)
    
    Fix certificate renewal scripts that use IPACertificate object:
    - renew_ca_cert adds the C flag to the trust flags and needs to
    be adapted to IPACertificate object
    - ipa-cacert-manage: fix python3 encoding issue
    
    https://pagure.io/freeipa/issue/7106
    
    Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>