Add ca_root_nss into jails templates.