Allow the admin user to be disabled
    
    A previous change made it not possible to remove the admin
    user. This also included disabling the admin user. The user can
    be disabled, just not deleted because it is required.
    
    Move the test test_ipa_cacert_manage_prune to the end of the
    class because it changes time which can break replication.
    
    Fixes: https://pagure.io/freeipa/issue/9489
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>