Extract ca_renewal cert update subroutine
    
    When the CA renewal master renews certificates that are shared
    across CA replicas, it puts them in LDAP for the other CA replicas
    to see.  The code to create/update these entries lives in the
    dogtag-ipa-ca-renew-agent renewal helper, but it will be useful for
    the ipa-cert-fix program too.  Extract it to a subroutine in the
    cainstance module.
    
    Part of: https://pagure.io/freeipa/issue/7885
    
    Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>