Make certmonger a (pre) requires on server, restart it before upgrading

certmonger may provide new CAs, as in the case from upgrading IPA 2.2
to 3.x. We need these new CAs available during the upgrade process.

The certmonger package does its own condrestart as part of %postun
which runs after the %post script of freeipa-server, so we need to
restart it ourselves before upgrading.

https://fedorahosted.org/freeipa/ticket/3378