Set mode of /etc/ipa/ca.crt to 0644 in CA-less installations
    
    It was previously being set to 0444 which triggered a warning
    in freeipa-healthcheck.
    
    Even root needs DAC_OVERRIDE capability to write to a 0o444 file
    which may not be available in some environments.
    
    https://pagure.io/freeipa/issue/8441
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>