ipa-ca-install: run certupdate as initial step
    
    When installing a CA replica, perform a certupdate to ensure that
    the relevant CA cert is present.  This is necessary if the admin has
    just promoted the topology from CA-less to CA-ful but didn't
    manually run ipa-certupdate afterwards.
    
    Fixes: https://pagure.io/freeipa/issue/6577
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>