Patrol MAI: switch to using external CAs

Also need to disable the zone guardian in the scenario for the time
being, until the guardian MAIs have also been converted.