Replace subsystem.select with CAInstance.is_crlgen_enabled()
    
    The subsystem.select is not a reliable indicator to determine
    whether the CA is a renewal master since there is no process in
    PKI to update the param when the role of the instance changes
    (from master to clone and vice versa) so the param has been
    removed in PKI 11.5.
    
    Instead, it's better to use CAInstance.is_crlgen_enabled() since
    CRL generation is only enabled in a renewal master.
    
    Signed-off-by: Endi Sukma Dewata <edewata@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>