PKINIT certificate: fix renewal on hidden replica
    
    The renewal of PKINIT cert on hidden replica is failing because
    of a test ensuring that the KDC service is either enabled or
    configured. The test needs to be extended and allow hidden, too.
    
    Fixes: https://pagure.io/freeipa/issue/9611
    Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>