Improve PKI subsystem detection
    
    The dogtaginstance.is_installed() method currently relies on
    the presence of the directory /var/lib/pki/pki-tomcat/{ca|kra},
    even if it is empty.
    An unwanted consequence is ipa-server-upgrade wrongly assuming the KRA
    is installed and crashing when trying to upgrade a not-installed
    component.
    
    The fix relies on the command "pki-server subsystem-show {ca|kra}" to
    detect if a subsystem is installed. The command does not require PKI
    to be running (hence can be called anytime) and is delivered by
    the pki-server package which is already required by ipa server pkg.
    
    Fixes: https://pagure.io/freeipa/issue/8596
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>