ipa-replica-install currently accepts both --setup-ca and *-cert-file even though the options should be mutually exclusive (either install CA-less with *-cert-file options or with a CA). Add a check enforcing the options are mutually exclusive. Fixes: https://pagure.io/freeipa/issue/8366 Reviewed-By: Rob Crittenden <rcritten@redhat.com>