certupdate: only add LWCA tracking requests on CA servers
    
    ipa-certupdate throws an exception when executed on a non-CA server
    in a CA-ful deployment with lightweight sub-CAs (LWCAs).  Check that
    we are on a CA server before attempting to create Certmonger
    tracking requests for LWCAs.
    
    HOW TO TEST
    
    1. Install first server (with CA)
    2. Install replica without CA
    3. Create sub-CA (`ipa ca-add`)
    4. Run `ipa-certupdate` on replica.  Observe that no stack trace is
       produced.
    
    Fixes: https://pagure.io/freeipa/issue/8399
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>