Always stop dirsrv in 'ipactl stop'

Ensure that 'ipactl stop' stops the dirsrv instance, even when no other
services are running.

https://fedorahosted.org/freeipa/ticket/3574
Require version of NSS that properly parses base64-encoded certs

There were cases where a base64-encoded cert with no header/footer would
not be handled properly and rejected. This was causing the CA install
to fail.

https://fedorahosted.org/freeipa/ticket/3586