ea67962 Reorder when ACME is enabled to fix failure on upgrade

Authored and Committed by rcritten a year ago
    Reorder when ACME is enabled to fix failure on upgrade
    
    On upgrading a server without ACME to one with ACME
    the RA Agent DN needs to be added as a member of the
    ACME Enterprise Users group. This was previously
    done as part of the creation of that entry.
    
    So on upgrade the RA Agent wouldn't be a member so
    ipa-acme-manage didn't have access to operate against
    the CA REST API.
    
    In order to add the RA Agent to this group during installation
    the ACME provisioning has to come after that step so it is
    moved from the middle of an installation to the end and
    the group addition moved into the setup_acme() method.
    
    https://pagure.io/freeipa/issue/8603
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>