net/freeipa-server: Fix client enrollment paths

ipa-join used the upstream default /etc/ipa/ca.crt, so it could not
build a
TLS context and enrollment stopped at "Unable to determine root DN". The
client port already patches this constant; the server port ships the
same
ipaclient tree and needs it too.

configure_krb5_snippet() copied its snippet into a krb5.conf.d that
nothing
creates, which aborted the install with FileNotFoundError. It now
creates
the directory, which is where FreeIPA points krb5.conf's includedir
anyway.

Reported by: usenix17
https://github.com/joneum/FreeBSD-freeipa-server/issues/3
Sponsored by: Netzkommune GmbH