If ipa-server-install --uninstall is called on a server that is CRL generation master, refuse uninstallation unless --ignore-last-of-role is specified or (in interactive mode) the admin is OK to force uninstallation. Related to https://pagure.io/freeipa/issue/5803 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>