ipa-cert-fix: fix spurious renewal master change
    
    We only want to become the renewal master if we actually renewed a
    shared certificate.  But there is a bug in the logic; even if the
    only Dogtag certificate to be renewed is the 'sslserver' (a
    non-shared certificate), the renewal master will be reset.  Fix the
    bug.
    
    A static type system would have excluded this bug.
    
    Part of: https://pagure.io/freeipa/issue/7885
    
    Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>