Instead of having defaults for all needed directories in the certificate
Python script, only make the state directory overridable since the
others are descendants of it.

This will ease integration testing as we will only need to expose the
state directory and the global trust directory.

To aid in integration tests, these must be editable via the
configuration file.

To be able to use the samba mock in the integration tests we need to
append to the PYTHONPATH variable instead of overriding it. This way
previously set paths will take precedence.

Removing a directory with `os.removedirs` will fail if it's non-empty.
We can circumvent this behavior by using `shutil.rmtree` instead.

Old data - policy configured & disabled
Up to date - policy configured & enabled

Some things to notice in the tests behavior:
- no changes to user golden files with no initial state
- purging machine policies removes the samba directory if it exists

Fixes UDENG-1059

Update the certificate test name to match the tested method name (and
our convention).