Handle missing LWCA certificate or chain
    
    If lightweight CA key replication has not completed, requests for
    the certificate or chain will return 404**.  This can occur in
    normal operation, and should be a temporary condition.  Detect this
    case and handle it by simply omitting the 'certificate' and/or
    'certificate_out' fields in the response, and add a warning message
    to the response.
    
    Also update the client-side plugin that handles the
    --certificate-out option.  Because the CLI will automatically print
    the warning message, if the expected field is missing from the
    response, just ignore it and continue processing.
    
    ** after the Dogtag NullPointerException gets fixed!
    
    Part of: https://pagure.io/freeipa/issue/7964
    
    Reviewed-By: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>