Fix salt provisioning validation

The problem was that I wanted to have a salt-master only (no salt-minion). So in this case, it should be allowed to set only the master keys (and no minion keys).

See: #2790