ipa-cert-fix: handle 'pki-server cert-fix' failure
    
    When DS cert is expired, 'pki-server cert-fix' will fail at the
    final step (restart).  When this case arises, ignore the
    CalledProcessError and continue.
    
    We can't know for sure if the error was due to failure of final
    restart, or something going wrong earlier.  But if it was a more
    serious failure, the next step (installing the renewed IPA-specific
    certificates) will fail.
    
    Part of: https://pagure.io/freeipa/issue/7885
    
    Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>