ca: reduce the number of places we store root CA certs

[dnephin]

The CAManager stores the root and intermediate certs in a number of places:

1. provider.ActiveRoot, and provider.ActiveIntermediate - currently in both primary and secondary, however addressing ca: Support separate Vault providers per DC #11159 would make ActiveRoot only apply in a primary and reduce one extra copies in the secondary
2. CAMananger.providerRoot - stores a copy that seems to be saved at the same time (but in slightly different ways) as the state store copy
3. state.Store - stores a copy that is persisted through raft and made available to other servers (not just the leader)
4. CAMananger.primaryRoots - (only in the secondary) stores another copy of the primary roots, which are already available in all the previous 3 places.

Storing the root in so many places can very easily lead to bugs, especially when the lifecycle or contents of these structs is subtly different. If we can reduce the number of places we store this data it becomes much easier to reason about the behaviour of the system.