Make PKINIT certificate request logic consistent with other installers
    
    The certmonger request handling code during pkinit setup actually never
    correctly handled situations when certificate request was rejected by
    the CA or CA was unreachable. This led to subtle errors caused by broken
    anonymous pkinit (e.g. failing WebUI logins) which are hard to debug.
    
    The code should behave as other service installers, e. g. use
    `request_and_wait_for_cert` method which raises hard error when request
    times out or is not granted by CA. On master contact Dogtag CA endpoint
    directly as is done in DS installation.
    
    https://pagure.io/freeipa/issue/6739
    
    Reviewed-By: Martin Basti <mbasti@redhat.com>
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>