dsinstance: extract function for writing certmap.conf
    
    For full customisability of the IPA CA subject DN, we will need the
    ability to update DS `certmap.conf' when upgrading a deployment from
    CA-less to CA-ful.
    
    Extract the existing behaviour, which is private to DsInstance, to
    the `write_certmap_conf' top-level function.
    
    Also update `certmap.conf.template' for substition of the whole CA
    subject DN (not just the subject base).
    
    Part of: https://fedorahosted.org/freeipa/ticket/2614
    
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>