ipa-cacert-manage: add --external-ca-type
    
    Add the `--external-ca-type`, as known from `ipa-server-install` and
    `ipa-ca-install`, to `ipa-cacert-manage`.
    
    This allows creating IPA CA CSRs suitable for use with Microsoft CS using
    `ipa-cacert-manage`:
    
    ```
    ipa-cacert-manage renew --external-ca --external-ca-type=ms-cs
    ```
    
    https://pagure.io/freeipa/issue/5799
    
    Reviewed-By: David Kupka <dkupka@redhat.com>
    Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>