Only pick up /etc/pki/tls and /etc/pki/ca-trust as certificate dirs

Only pick up /etc/pki/tls and /etc/pki/ca-trust as certificate dirs

Extra rpm GPG keys can be configured in /etc/pki/rpm-gpg. Let's not
assume /etc/pki consists solely of certificates but instead, let's pick
out the two directories out of there that do concern themselves with
certificates.

This allows copying extra rpm gpg keys to /etc/pki/rpm-gpg with
SandboxTrees= without these getting overridden by the /etc/pki bind
mount we used to have before.

Fixes #3687