Add cleanup logic to remove old CA related material

After the root CA certificate related changes are integrated to client side (OM, Datanode, Recon) the old material to root CA and sub CAs signed by that root CA can be removed. This should only be done after the old root CA certificate has expired just to make sure nothing goes wrong.