When >= queens ceilometer uses the identity-credentials relation
rather than the identity-service relation. When using HTTPS
ceilometer still needs the CA certificate from keystone.

This change sets up the CA when using the identity-credentials
relation.

Please merge https://github.com/juju/charm-helpers/pull/124 first.

Change-Id: I7c6ca1d913ad8b8123685a064933031f322869df