Make PKCS#12 handling in ipa-server-certinstall closer to what other tools do.

In particular, PKCS#12 validation and server certificate selection is now done
the same way as in ipa-server-install and ipa-replica-prepare.

https://fedorahosted.org/freeipa/ticket/3641
Port ipa-server-certinstall to the admintool framework.

Change the log file path from /var/log/ipa/default.log to admintool's default
path.

https://fedorahosted.org/freeipa/ticket/3641
Remove unused NSSDatabase and CertDB method find_root_cert_from_pkcs12.

https://fedorahosted.org/freeipa/ticket/3641
Ignore empty mod error when updating DS SSL config in ipa-server-certinstall.

https://fedorahosted.org/freeipa/ticket/3641
Replace only the cert instead of the whole NSS DB in ipa-server-certinstall.

https://fedorahosted.org/freeipa/ticket/3641
Untrack old and track new cert with certmonger in ipa-server-certinstall.

https://fedorahosted.org/freeipa/ticket/3641
Add --pin option to ipa-server-certinstall.

Hide the unnecessary --dirsrv_pin and --http_pin options.

https://fedorahosted.org/freeipa/ticket/3869
Ask for PKCS#12 password interactively in ipa-server-certinstall.

https://fedorahosted.org/freeipa/ticket/3641
Fix broken replica installation

Make sure the subject base parameter is correctly passed and used during the
creation of the DS instance on a replica.

https://fedorahosted.org/freeipa/ticket/3868