Don't allow a non-empty CA certificate in production code.

The caCertificate field in ResolverParamsParcel is documented as
being for testing only. Because setting it could have security
implications, don't allow the system server to pass it in.

Bug: 144475682
Test: existing tests pass
Change-Id: Ie0b826127cc48f18945a9de5f3579e47706462ee