Don't generate a cafile on HSM instalations
    
    We don't export the CA certificates on an HSM installation
    because an HSM won't allow the private keys to leave the
    HSM, by design.
    
    Fixes: https://pagure.io/freeipa/issue/9273
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>