upgrade: update KRA tracking requests
    
    The upgrade routine checks tracking requests for CA system
    certificates, IPA RA and HTTP/LDAP/KDC service certificates.  If a
    tracking request matching our expectations is not found, we stop
    tracking all certificates, then create new tracking requests with
    the correct configuration.
    
    But the KRA was left out.  Add checks for KRA certificates, and
    remove/recreate KRA tracking requests when appropriate.
    
    Part of: https://pagure.io/freeipa/issue/7991
    
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>