Turn on NSSOCSP check in mod_nss conf
    
    Turn on NSSOCSP directive during install/replica install/upgrade.
    That check whether the certificate which is used for login is
    revoked or not using OSCP.
    
    Marks the server cert in httpd NSS DB as trusted peer ('P,,')
    to avoid chicken and egg problem when it is needed to contact
    the OCSP responder when httpd is starting.
    
    https://pagure.io/freeipa/issue/6370
    
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    Reviewed-By: Martin Basti <mbasti@redhat.com>