Reconfiguring Connect CA to Built-in from Vault doesn't write Certs

#### Overview of the Issue

I'm on Consul 1.13.6 currently, I am using the `connect/ca/configuration` endpoint to reconfigure from using the Vault CA provider, to the Consul Built in.

I'm setting it such that my config does not include a root or private key, and have removed the configuration for the paths to them in my servers configuration.

When I do this and restart consul, I can hit the `connect/ca/roots` endpoint and see the new root certificate, however it doesn't look like its written anywhere, nor is a private key. I am also unable to specify `cert_file` and `key_file` in the hops that if they are not there, it writes them.

As such it makes this difficult to be idempotent, as I cannot use something like vault to store these generated values, and consul fails to start as "no cert_file is specified" or "key_file does not match cert_file".

---

#### Reproduction Steps

1. Configure Consul with a valid Vault CA provider configuration
2. Use the `connect/ca/configuration` endpoint with a basic configuration of:
```json
{
"Provider":"consul",
"ForceWithoutCrossSigning":true
}
```
3. remove the `cert_file` and `ca_file` keys
4. restart consul

### Consul info for both Client and Server

Server info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = 61547a41
version = 1.13.6
version_metadata =
consul:
acl = enabled
bootstrap = false
known_datacenters = 2
leader = false
leader_addr =
server = true
raft:
applied_index = 12323864
commit_index = 0
fsm_pending = 0
last_contact = never
last_log_index = 12333022
last_log_term = 205821
last_snapshot_index = 12323864
last_snapshot_term = 205817
latest_configuration = [{REDACTED}]
latest_configuration_index = 0
num_peers = 0
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Follower
term = 205821
runtime:
arch = amd64
cpu_count = 2
goroutines = 101
max_procs = 2
os = linux
version = go1.18.9
serf_lan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 259
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 130662
members = 4
query_queue = 0
query_time = 50
serf_wan:
coordinate_resets = 0
encrypted = true
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 38107
members = 6
query_queue = 0
query_time = 1
```

### Operating system and Environment details

EC2 Amazon Linux 2 AWS

Start by tracing the connect/ca/configuration endpoint and the restart path described in the reproduction steps, focusing on the Consul built-in CA provider. Done means switching from Vault to the built-in provider persists the generated root certificate and private key, and Consul restarts successfully without manually supplied cert_file or key_file values.

Written by the indexing model from the issue text.