Modify how IPA configuration is detected and what is issued

Drop the "is-IPA-configured" fact and use $onlyif in the Exec
instead. This is rather simplistic but is no worse than the fact.

Drop the semaphore file for NSS-based certificates and and
File entries for OpenSSL certs and keys and replace with an
$unless call to use certmonger to determine whether a given
certificate is already being tracked. This is a lot less
error-prone.
Use Service instead of Package for requiring certmonger

By using package it is possible that the certmonger package is
installed but not running. By depending on the Service instead
the ensure => running will be triggered and certmonger started
if needed.
Become 1.0.3