Remove ipa-ca.crt from systemwide CA store on client uninstall and cert update
    
    The file was used by previous versions of IPA to provide the IPA CA certificate
    to p11-kit and has since been obsoleted by ipa.p11-kit, a file which contains
    all the CA certificates and associated trust policy from the LDAP certificate
    store.
    
    Since p11-kit is hooked into /etc/httpd/alias, ipa-ca.crt must be removed to
    prevent certificate import failures in installer code.
    
    Also add ipa.p11-kit to the files owned by the freeipa-python package.
    
    https://fedorahosted.org/freeipa/ticket/3259
    
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>