server upgrade: do not enable PKINIT by default
    
    Enabling PKINIT often fails during server upgrade when requesting the KDC
    certificate.
    
    Now that PKINIT can be enabled post-install using ipa-pkinit-manage, avoid
    the upgrade failure by not enabling PKINIT by default.
    
    https://pagure.io/freeipa/issue/7000
    
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>