selinux: disable ipa_custodia when installing custom policy
    
    Since ipa_custodia got integrated into ipa policy package, the upstream policy
    module needs to be disabled before ipa module installation (in order to be able
    to make changes to the ipa_custodia policy definitions).
    Upstream ipa module gets overridden automatically because of higher priority of
    the custom module, but there is no mechanism to automatically disable
    ipa_custodia.
    
    Related: https://pagure.io/freeipa/issue/6891
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>