openvpn: make crl.pem public

The CRL has to be accessed by the running openvpn daemon and
contains only public info, so this copies it out of the sealed
keys/ directory and makes it 0644.