Fix some restart script issues found with certificate renewal.
    
    The restart_dirsrv script wasn't initializing the api so the
    startup_timeout wasn't available.
    
    The subsystemCert cert-pki-ca definition was missing so we didn't
    know which certificate to update in CS.cfg.
    
    Add some documentation and a pause between restarts for the
    renew_ca_cert script so that when the CA subsystem certs are renewed
    they don't all try to restart the CA at the same time.
    
    https://fedorahosted.org/freeipa/ticket/3006