ipaclient_setup_nss: Fix undefined ca_certs for NoCertificateError case

In case get_certs_from_ldap failed with errors.NoCertificateError the
code lead to a trace back as certstore.make_compat_ca_certs was using
with undefined ca_certs variable.

The code to generate ca_certs for this case was copied over from
ipaclient_api. This is loading the certificate list from paths.IPA_CA_CRT.