The CCE broker is live at broker.cce.dkfz.de, so the test broker at
test-no-real-data.broker.samply.de is no longer the CCE broker.
BROKER_ID roots the Beam PKI namespace, so this moves the proxy id to
cce-master.broker.cce.dkfz.de and the app ids derived from it --
cce/root.crt.pem still pins the old broker's CA and must be replaced
with the new one, and the proxy has to be re-enrolled before the
bridgehead connects again.