client install: create /etc/ipa/nssdb with correct mode
    
    The NSS database directory is created with mode 640, which causes the IPA
    client to fail to connect to any IPA server, because it is unable to read
    trusted CA certificates from the NSS database.
    
    Create the directory with mode 644 to fix the issue.
    
    https://fedorahosted.org/freeipa/ticket/5959
    
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>