client install: fix client PKINIT configuration

Set `pkinit_anchors` in `krb5.conf` to a CA certificate bundle of CAs
trusted to issue KDC certificates rather than `/etc/ipa/ca.crt`.

Set `pkinit_pool` in `krb5.conf` to a CA certificate bundle of all CAs
known to IPA.

Make sure both bundles are exported in all installation code paths.

https://pagure.io/freeipa/issue/6831

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>

install/share/krb5.conf.template

@@ -21,7 +21,8 @@ $OTHER_LIBDEFAULTS
   master_kdc = $FQDN:88
   admin_server = $FQDN:749
   default_domain = $DOMAIN
-  pkinit_anchors = FILE:/etc/ipa/ca.crt
+  pkinit_anchors = FILE:$KDC_CA_BUNDLE_PEM
+  pkinit_pool = FILE:$CA_BUNDLE_PEM
 }
 
 [domain_realm]