Backport logic to detect migrated CA dir location

In Puppet 7, we added logic to Puppet's settings defaults to detect whether the CA dir was in the old (SSL dir) location or in the new migrated location. We need to backport this detection logic to 6.x, with the default case reversed: we want to only return the new location if the dir already exists there, indicating that the CA dir has been migrated, and return the SSL dir location otherwise.