Request for enhancement

PR https://github.com/freeipa/freeipa/pull/1232 improves the administrator experience
after promoting CA-less deployment to CA-ful. It addresses a couple of scenarios:

1. After installing a CA in a CA-less deployment, the new CA certificate is not installed in
   /etc/httpd/alias. This causes communication failure between IPA framework
   and Dogtag (it cannot verify the Dogtag server certificate). Now we perform an
   ipa-certupdate automatically as final step of ipa-ca-install.

   Therefore we need an integration test that immediately after CA-less -> CA-ful promotion,
   ca-related commands work.

2. After promoting CA-less -> CA-ful on a master, other replicas do not have the CA certificate
   in their trust stores. This causes failure of CA replica installation (via ipa-ca-install) on
   the replica. The PR modified ipa-ca-install to do ipa-certupdate as the first step of
   CA replica installation.

   Therefore we need an integration test that, immediately after CA-less -> CA-ful promotion
   of one master, verifies that CA replica installation on another master succeeds.