Require an ipa-ca SAN on 3rd party certs if ACME is enabled
    
    ACME requires an ipa-ca SAN to have a fixed URL to connect to.
    If the Apache certificate is replaced by a 3rd party cert then
    it must provide this SAN otherwise it will break ACME.
    
    https://pagure.io/freeipa/issue/8498
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
    Reviewed-By: Mohammad Rizwan <myusuf@redhat.com>