ipatests: add test for PKINIT renewal on hidden replica
    
    Test scenario: on a hidden replica, force the renewal of
    PKINIT cert by calling getcert resubmit.
    
    Related: https://pagure.io/freeipa/issue/9611
    Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>