cainstance: add function to determine ca_renewal nickname
    
    The ipa-cert-fix program needs to know where to put shared
    certificates.  Extract the logic that computes the nickname from
    dogtag-ipa-ca-renew-agent to new subroutine
    cainstance.get_ca_renewal_nickname().
    
    Part of: https://pagure.io/freeipa/issue/7885
    
    Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>