ipa-cacert-manage renew: switch from ext-signed CA to self-signed
    
    The scenario switching from externally signed CA to self-signed CA is
    currently failing because the certmonger helper goes through the wrong
    code path when the cert is not self-signed.
    
    When the cert is not self-signed but the admin wants to switch to self-signed
    a new cert needs to be requested, not retrieved from LDAP.
    
    https://pagure.io/freeipa/issue/7173
    
    Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>