Empty nss.conf avoids recreation of nss.conf in case `mod_nss` package is reinstalled. It is needed because by default (e.g. recreated) nss.conf has `Listen 8443` while this port is used by dogtag. Fixes: https://pagure.io/freeipa/issue/7745 Reviewed-By: Christian Heimes <cheimes@redhat.com>