Fix upgrade when Dogtag also upgraded from 10.2 -> 10.3
    
    ipa-server-upgrade from pre-lightweight CAs version fails when
    Dogtag is also being upgraded from pre-lightweight CAs version,
    because Dogtag needs to be restarted after adding the lightweight
    CAs container, before requesting information about the host
    authority.
    
    Move the addition of the Dogtag lightweight CAs container entry a
    bit earlier in the upgrade procedure, ensuring restart.
    
    Fixes: https://fedorahosted.org/freeipa/ticket/6011
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>