krb5: make sure KDC certificate is readable
    
    When requesting certificate for KDC profile, make sure its public part
    is actually readable to others.
    
    Fixes https://pagure.io/freeipa/issue/6973
    
    Reviewed-By: Simo Sorce <ssorce@redhat.com>
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>