Convert PKCS12 cacert to JKS
As described in debian bug #898678 an existing cacerts that was previously generated in PKCS12 needs to be converted to JKS.
This merge request is split into separated commits to reflect the required refactorings as well as the following changes/fixes:
- depend on openjdk-11-jre-headless for Ubuntu and derivatives
- export JAVA_HOME and update PATH if, and only if, an existing jvm is found