ca/cert-show: check certificate_out in options
    
    If --certificate-out was specified on the command line, it will appear
    among the options. If it was empty, it will be None.
    
    This check was done properly in the ca plugin. Lets' just unify how this
    is handled and improve user experience by announcing which option causes
    the failure.
    
    https://pagure.io/freeipa/issue/6885
    
    Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>