Title: #5329: [Backport][ipa-4-6] Improve PKI subsystem detection
This is a manual backport of PR #5290 to ipa-4-6 branch.
Cherry-pick had issues with the tests commit (missing imports, line length).
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5329/head:pr5329
git checkout pr5329