pkinit setup: fix regression on master install
    
    The commit 7785210 intended to fix ipa-pkinit-manage enable
    on a replica without any CA but introduced a regression:
    ipa-server-install fails to configure pkinit with the fix.
    
    This commit provides a proper fix without the regression:
    pkinit needs to contact Dogtag directly only in case there is
    no CA instance yet (for ex. because we are installing the
    first master).
    
    Fixes: https://pagure.io/freeipa/issue/7795
    Reviewed-By: François Cami <fcami@redhat.com>