ipa-pki-proxy: allow certificate and password authentication
    
    ipa-replica-install --setup-ca is failing because the security
    domain login attempts password authentication, but the current
    ipa-pki-proxy requires certificate authentication.
    
    Set NSSVerifyClient optional to allow both certificate and password
    authentication to work.
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>