ipa-ca-install: append CA cert chain into /etc/ipa/ca.crt
    
    ipa-ca-install currently overwrites /etc/ipa/ca.crt with the CA chain
    retrieved from Dogtag. It should instead append the new certs, otherwise
    the CA that signed dirsrv and httpd certificates is removed and ipa tools
    fail.
    A consequence is that ipa-kra-install fails.
    This is a regression introduced by 5ab85b36.
    
    https://pagure.io/freeipa/issue/6925
    
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>