Upgrade: configure local/full PKINIT depending on the master status
    
    The upgrader has been modified to configure either local or full PKINIT
    depending on the CA status. Additionally, the new PKINIT configuration
    will be written to the master's KDC entry.
    
    https://pagure.io/freeipa/issue/6830
    http://www.freeipa.org/page/V4/Kerberos_PKINIT
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Jan Cholasta <jcholast@redhat.com>
    Reviewed-By: Martin Basti <mbasti@redhat.com>
    Reviewed-By: Simo Sorce <ssorce@redhat.com>