dogtag-ipa-ca-renew-agent: always use profile-based renewal
    
    Update the renewal helper to always request a new certificate
    ("enrollment request") instead of using "renewal request".  The
    latter is brittle in the face of:
    
    - missing certificate record in database
    
    - missing original request record in database (pointed to by
      certificate record)
    
    - "mismatched" certificate or request records (there have been many
      cases of this; it is suspected that request/serial range conflicts,
      or something similar, may be the cause)
    
    The Dogtag tracking request must know what profile to use, except
    where the certificate uses the default profile ("caServerCert" per
    'dogtag-ipa-renew-agent' implementation in Certmonger itself).
    This part of the puzzle was dealt with in previous commits.
    
    Part of: https://pagure.io/freeipa/issue/7991
    
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>