`secondaryCARootWatch` will not sign intermediates until the roots have changed or the RPC monitoring the roots times out.

The `secondaryCARootsWatch` function runs a loop where the first things done is a blocking query on the CA roots of the primary. Under normal operations this is fine. However if the intermediate CA has not been fully initialized due to intermediate signing or provider errors then it could take a long time for these to get fixed (10 minutes for the RPC to time out).

This came up when I was writing a test to ensure the intermediate CA signing failing during `establishLeadership` would not prevent successfully finishing and allow the node to be the leader. Instead leadership is transferred to another node (which will then fail for the same reason). This ended up in a never ending leader election loop.

It would be desirable when we have not yet fully setup the intermediate CA to retry that operation independently of getting a root CA update. This would allow us to write a test for pr #6383 more directly where we are specifically testing the intermediate CA signing failure followed by updating the ACL token to allow the operation to work and then watching everything finish getting initialized. Right now that test would take 10 minutes but once we fix this function that test should also be implemented.