Only filter out CA certificates for xpack.security.http.ssl keystore

[BigPandaToo]

This is related to Security on by default feature
development. When handling the case of multiple
keys in the key store (see #73807) we should only
filter out CA certificates if there are multiple entries
and if it is xpack.security.http.ssl keystore.
The detection of the type of the keystore will be easy
after the merge of #72285.

Related: #73807
Depends: #72285

[elasticmachine]

Pinging @elastic/es-security (Team:Security)