Bug 1974328

This bug was initially created as a copy of Bug #1886837

I am copying this bug because: 

The bug is also present in RHEL7 and difficult to diagnose. The fix will help reduce customer cases load.

This bug is created as a clone of upstream ticket:
https://pagure.io/freeipa/issue/8532

I am reading through PKINIT upgrade and setup code and I think we have logical bug in ipa-pkinit-manage and in the upgrade code:
1. ipa-pkinit-manage never calls krbinstance's setup_pkinit() on enable, so we are never able to enable the certificate issuance through it even though we are able to disable one
2. upgrade code only allows to issue self-signed certificates if certificates are missing

as a result, there is no way to upgrade from self-signed to CA-based and the way it is done, even if you'd do reissue, the issuer will still be left `cn=<hostname>`, without EKUs we need, so it will not work for web UI logon FAST wrapping.

We have to reissue cert properly and there is nothing that would do it -- as nothing calls into krb instance's `setup_pkinit()`.

a manual fix is to force reissue of the PKINIT certificate against the right CA with right issuer and EKUs:
```
ipa-getcert rekey -f /var/kerberos/krb5kdc/kdc.crt -U id-kp-serverAuth -U id-pkinit-KPKdc -K krbtgt/IPA.TEST -T KDCs_PKINIT_Certs -X IPA
```

but we need to revise upgrade code and `ipa-pkinit-manage` to make sure we are taking care of the conversion of 'bogus' PKINIT certificate to the correct one, whether self-signed or IPA CA.