Fix the order of cert-files check
    
    Without this patch, if either of dirsrv_cert_files, http_cert_files
    or pkinit_cert_files is set along with no-pkinit, the user is first
    requested to add the remaining options and when they do that,
    they are told that they are using 'no-pkinit' along with
    'pkinit-cert-file'.
    
    https://pagure.io/freeipa/issue/6801
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>