Use of direct designate CLI calls (<= Ocata) with SSL fails

[David Ames]

The designate charm <= Ocata uses direct calls to the CLI client designate. This leverages an RC file /root/novarc. The template for novarc [0] is not SSL aware.

The charm will need to wait for keystone's identity-service.available.ssl and render with OS_CACERT set as well as the correct URL for keystone.

This only affects <= Ocata and can be re-created using the openstack-mojo-specs full designate_ha spec.

There is also a potential race with rabbitmq's SSL settings.

If the charm is running the certificates-relation-* hooks it should unset flags that suggest it is ready and wait for keystone and rabbit to be SSL complete.

[0] https://github.com/openstack/charm-designate/blob/c3b888c07b90ddf08b671857db04855207d09444/src/templates/novarc