Added support for Debian ssl-cert package in 'pki'

Private directories of the PKI infrastructure (/srv/pki/ca/private/,
/srv/pki/host/private/) and files inside are now owned by root:ssl-cert
by default (configurable). It should allow packages that use ssl-cert
package to access private keys in these directories.