[freeipa PR#769][comment] test_caless: add pkinit option and test it

[stlaz]

  URL: https://github.com/freeipa/freeipa/pull/769
Title: #769: test_caless: add pkinit option and test it

stlaz commented:
"""
Please add the `xfail` part to another commit, put appropriate tracker tickets to the
commit messages. I believe we should probably file a ticket that `ipa-server-certinstall`
should add any intermediate CA certs a server cert is signed with and put that one in the
`xfail` description so that we don't have a closed ticket there.
"""

See the full comment at
https://github.com/freeipa/freeipa/pull/769#issuecomment-302631220