Support MS CS as the external CA in ipa-server-install and ipa-ca-install
    
    Added a new option --external-ca-type which specifies the type of the
    external CA. It can be either "generic" (the default) or "ms-cs". If "ms-cs"
    is selected, the CSR generated for the IPA CA will include MS template name
    extension (OID 1.3.6.1.4.1.311.20.2) with template name "SubCA".
    
    https://fedorahosted.org/freeipa/ticket/4496
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>