ipatests: add integration test for pkinit enable on replica
    
    ipa-pkinit-manage enable was failing when run on a replica
    without a CA instance.
    Add a test with the following scenario:
    - install a replica with --no-pkinit
    - check that the KDC cert is self signed
    - call ipa-pkinit-manage enable
    - check that the KDC cert is signed by IPA CA
    
    Related to https://pagure.io/freeipa/issue/7795
    
    Reviewed-By: Francois Cami <fcami@redhat.com>