Add custodia store for lightweight CA key replication
    
    Due to limitations in Dogtag's use of NSSDB, importing private keys
    must be done by the Dogtag Java process itself.  This requires a
    PKIArchiveOptions format (signing key wrapped with host CA key) -
    PKCS #12 cannot be used because that would require decrypting the
    key in Dogtag's memory, albeit temporarily.
    
    Add a new custodia store that executes a 'pki' command to acquire
    the wrapped key.
    
    Part of: https://fedorahosted.org/freeipa/ticket/4559
    
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>