CA: set ipaconfigstring:compatCA in cn=DOMAIN IPA CA
    
    Commit fa50068 introduced a regression. Previously, the
    upgrade plugin upload_cacrt was setting the attribute
    ipaconfigstring: compatCA in the entry
    cn=DOMAIN IPA CA,cn=certificates,cn=ipa,cn=etc,BASEDN
    
    After commit fa50068, the value is not set any more. As a
    consequence, the LDAP entry is not identified as the CA and
    CA renewal does not update the entry
    cn=CAcert,cn=certificates,cn=ipa,cn=etc,BASEDN.
    
    RHEL 6 client rely on this entry to retrieve the CA and
    client install fails because cn=CAcert is out-of-date.
    
    The fix makes sure that upload_cacrt plugin properly sets
    ipaconfigstring: compatCA in the entry
    cn=DOMAIN IPA CA,cn=certificates,cn=ipa,cn=etc,BASEDN
    
    Fixed: https://pagure.io/freeipa/issue/7928
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>