This was previously spread around the code as 'when:' clauses on ansible
tasks.
This patch refactors the conditional code to be entirely within the
dynamic generation of variables in vars/main.yml. Any elements from
the default or discovered CA or certificate lists which have
condition=false are removed, so no conditionals are required elsewhere
in the code.
pki_authorities and pki_certificates are defined as empty lists in the
ansible defaults to further reduce the need for the use of default()
in the rest of the role.
Depends-On: https://review.opendev.org/c/openstack/openstack-ansible/+/830806
Change-Id: Iea809406b1d4140b985fcb038663ae0257336463
9108a8953f