upgrade: do not try to start CA if not configured
The upgrade script always attempts to start the CA, even on
instances where the CA is not configured. Add guards.
Fixes: https://fedorahosted.org/freeipa/ticket/5958
Reviewed-By: Petr Spacek <pspacek@redhat.com>