Require new selinux-policy replacing old server-selinux subpackage
    
    Features of the new policy:
    - labels /var/lib/ipa/pki-ca/publish as pki_tomcat_cert_t which is
      writeable by PKI and readable by HTTPD
    - contains Conflicts with old freeipa-server-selinux package to avoid
      SELinux upgrade issues
    
    https://fedorahosted.org/freeipa/ticket/3788