ca: reduce the number of places we store root CA certs

The `CAManager` stores the root and intermediate certs in a number of places:

1. `provider.ActiveRoot`, and `provider.ActiveIntermediate` - currently in both primary and secondary, however addressing #11159 would make `ActiveRoot` only apply in a primary and reduce one extra copies in the secondary
1. `CAMananger.providerRoot` - stores a copy that seems to be saved at the same time (but in slightly different ways) as the state store copy
1. `state.Store` - stores a copy that is persisted through raft and made available to other servers (not just the leader)
1. `CAMananger.primaryRoots` - (only in the secondary) stores another copy of the primary roots, which are already available in all the previous 3 places.

Storing the root in so many places can very easily lead to bugs, especially when the lifecycle or contents of these structs is subtly different. If we can reduce the number of places we store this data it becomes much easier to reason about the behaviour of the system.

Start by tracing CAManager.providerRoot, provider.ActiveRoot, provider.ActiveIntermediate, state.Store, and CAManager.primaryRoots to compare their lifecycles and consumers. Determine which copies can be removed without changing primary, secondary, or Raft-backed behavior. Done means root and intermediate certificates have fewer storage locations and the affected lifecycle behavior remains correct.

Written by the indexing model from the issue text.