kra: set RSA-OAEP as default wrapping algo when FIPS is enabled
    
    Vault uses PKCS1v15 as default padding wrapping algo, which is not an approved
    FIPS algorithm. This commit ensures that KRA is installed with RSA-OAEP if FIPS
    is enabled. It also handles upgrade path.
    
    Fixes: https://pagure.io/freeipa/issue/9191
    
    Signed-off-by: Francisco Trivino <ftrivino@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>