ipa/client: Don't apply hosts role on non-VPN hosts
    
    We don't want a custom /etc/hosts installed on every host, so bring back
    the conditional.
    
    Improves commit 7a2024398f223a49fc061576512fe2619bfc1d02.
    
    Signed-off-by: Nils Philippsen <nils@redhat.com>