Bug 1436715

Cloned from upstream: https://pagure.io/freeipa/issue/6787

In issue #6652 a new cache for KRA transport certs was introduced. The new cache uses a combination of file system cache and in-memory cache. The in-memory cache has a higher precedence than the fs cache. Once loaded, the in-memory cache is never synced from the file system again.

For a forking service like Custodia, this results in a performance regression and concurrency issues. Custodia initializes the KRA transport cert cache in the main process right before the server socket listens on incoming requests. Since all requests are handled in forked child processes, the in-memory cache of the server process is created once and never updated. This can lead to performance regressions in case the KRA cert is updated:

1. master process stores KRA cert in-memory and on-fs
2. External process modifies KRA cert of the KRA subsystem
3. Custodia requests comes in, server forks child process
3. child process uses old KRA cert for first write attempt, fails
4. child processes fetches new cert and stores it in memory and on fs
5. child process uses new cert to attempt second write

Steps 3 to 5 are repeated over and over again because the child can't modify the in-memory cache of the parent process.

Proposed solution: Use a simpler implementation that uses an atomic on-filesystem cache.

Further more there is a bug in the new KRA cache code. On one occasion a ```logger.info()``` has a format string with two ```%s``` but just one positional argument. This causes the cache to break with a ```TypeError: not enough arguments for format string``` exception.