Do not renew the IPA CA cert by serial number in dogtag-ipa-ca-renew-agent
    
    Always use the full CSR when renewing the IPA CA certificate with Dogtag. The
    IPA CA certificate may be issued by an external CA, in which case renewal by
    serial number does not make sense and will fail if the IPA CA was initially
    installed as a subordinate of an external CA.
    
    https://fedorahosted.org/freeipa/ticket/4784
    
    Reviewed-By: David Kupka <dkupka@redhat.com>