ca: fix ca-find with --pkey-only
    
    Since commit 32b1743e5fb318b226a602ec8d9a4b6ef2a25c9d, ca-find will fail
    with internal error if --pkey-only is specified, because the code to
    look up the CA certificate and certificate chain assumes that the ipaCAId
    attribute is always present in the result.
    
    Fix this by not attempting to lookup the certificate / chain at all when
    --pkey-only is specified.
    
    https://fedorahosted.org/freeipa/ticket/6178
    
    Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>