Federation level operator should be able to upload "default" CA

[restena-sw]

Some federations have a homogeneous certificate landscape: the federation operator may have its own special-purpose CA for all of its clients; or all institutions get certificates from the same commercial CA.
A feature was requested to allow the federation operator to upload the "default root CA" for their federation; every newly created institution would then be primed with that CA during enrollment.