Stupid `cp` will fail if the source dir is empty
Also supports `extra_ca_certs` being a single file, which is useful for the Kubernetes configmap case Fixes https://www.pivotaltracker.com/story/show/134302623
This change moves the LDAP cert installation into a common script and reorganizes the startup scripts for creating and installing these certs Fixes #1846