ipatest: add test for ipa-pkinit-manage enable|disable
    
    Add a test for ipa-pkinit-manage with the following scenario:
    - install master with option --no-pkinit
    - call ipa-pkinit-manage enable
    - call ipa-pkinit-manage disable
    - call ipa-pkinit-manage enable
    
    At each step, check that the PKINIT cert is consistent with the
    expectations: when pkinit is enabled, the cert is signed by IPA
    CA and tracked by 'IPA' ca helper, but when pkinit is disabled,
    the cert is self-signed and tracked by 'SelfSign' CA helper.
    
    The new test is added in the nightly definitons.
    
    Related to https://pagure.io/freeipa/issue/7200
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>