certctl: replace hardcoded uses of /usr/local

Use the new user.localbase sysctl here as well, to reduce the number of
hardcoded localbase by one (1).

(cherry picked from commit b799d38a2ad10ec84c8ffa4a554a1816465c0d12)