don't run ldapsearch to check if client already enrolled.

we've disabled anonymous ldap bind, so we can't check LDAP to see if
computer has been enrolled. However, a successful ipa-client-install run
leaves /etc/ipa/ca.crt file, so we can just check if it exists before
running it again.