upcate-ca-trust: Use "trust" command instead of "p11-kit extract"
    
    The main motivation behind this is to allow the p11-kit utilities to
    be split into a subpackage (p11-kit-tools).  As ca-certificates only
    uses "p11-kit extract" command invocation, which can be replaced with
    "trust" command, we only need the p11-kit-trust package at
    installation time.
    
    Signed-off-by: Daiki Ueno <dueno@redhat.com>