Ensure correct IPA CA nickname in DS and HTTP NSSDBs
    
    During replica installation, if the IPA deployment has a custom
    subject_base, the routines that create the DS and HTTP NSSDBs
    erroneously compare the subject of CA certs to the *default* subject
    base. This causes the IPA CA cert to be added to the NSSDBs with a
    nickname derived from the subject name, instead of "{REALM} IPA CA".
    
    At a later stage of installation, the `upload_cacrt` plugin reads
    certs from the HTTP NSSDB in order to update the cn=certificates
    LDAP certstore.  The NSSDB nickname of the cert is used as the CN
    for the entry.  Because the IPA CA cert was not installed in the
    HTTP NSSDB with the "{REALM} IPA CA", this causes a spurious entry
    for the IPA CA to be added to the certstore.
    
    To avoid this scenario, use the deployment's actual subject base
    when deciding if a cert is the IPA CA cert.
    
    Fixes: https://fedorahosted.org/freeipa/ticket/6415
    Reviewed-By: Tomas Krizek <tkrizek@redhat.com>