kra: promote: Get ticket before calling custodia
    
    When installing second (or consequent) KRA instance keys are retrieved
    using custodia. Custodia checks that the keys are synchronized in
    master's directory server and the check uses GSSAPI and therefore fails
    if there's no ticket in ccache.
    
    https://pagure.io/freeipa/issue/7020
    
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>