server install: do not attempt to issue PKINIT cert in CA-less
    
    Require the user to provide the PKINIT cert with --pkinit-cert-file or
    disable PKINIT with --no-pkinit in CA-less ipa-server-install,
    ipa-replica-prepare and ipa-replica-install.
    
    Do not attempt to issue the PKINIT cert in CA-less ipa-server-upgrade.
    
    https://pagure.io/freeipa/issue/5678
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>