updates for cooperation with a new version of ca-certificates-java

In 2016 I fixed ca-certificates.crt to be created during the postinst configure (not the delayed trigger), but running update-ca-certificates without hooks causes these updates to be lost for the hooks.

I've now done a complete overhaul of ca-certificates-java and its hook script will only record the pending actions for later processing by its own triggers. Therefore the hook script is save to be called independent of the configuration state of ca-certificates-java or its rdepends. And we can get rid of that hack in ca-certificates again.