Require JSS 4.4.4 with fix for sub CA replication
    
    The SQL backend of NSS behaves differently than the DBM backend.
    Specifically PK11_UnwrapPrivateKey generates a different CKA_ID. JSS 4.4.4
    contains a workaround for broken sub CA replication.
    
    Note: FreeIPA doesn't depend on JSS directly. The version requirement
    was added to update JSS to a working version
    
    See: https://bugzilla.redhat.com/show_bug.cgi?id=1583140
    Fixes: https://pagure.io/freeipa/issue/7536
    Signed-off-by: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>