Ensure that public cert and CA bundle are readable
    
    In CIS hardened mode, the process umask is 027. This results in some
    files not being world readable. Ensure that write_certificate_list()
    calls in client installer, server installer, and upgrader create cert
    bundles with permission bits 0644.
    
    Fixes: https://pagure.io/freeipa/issue/7594
    Signed-off-by: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>