ipaserver: Use Custodia instance in installers and setup before CA

Custodia is configured before CA and used in the setup of CA. Also add
support for name FIRST_MASTER as a replacement for MASTER_PEER.

This is related to the freeipa upstream commits:

Use single Custodia instance in installers:
  https://github.com/freeipa/freeipa/commit/994f71a
Rename CustodiaModes.STANDALONE to CustodiaModes.FIRST_MASTER:
  https://github.com/freeipa/freeipa/commit/842cb5f

roles/ipaserver/tasks/install.yml

@@ -206,6 +206,12 @@
       idmax: "{{ result_ipaserver_test.idmax }}"
       _pkinit_pkcs12_info: "{{ result_ipaserver_test._pkinit_pkcs12_info }}"
 
+  - name: Install - Setup custodia
+    ipaserver_setup_custodia:
+      realm: "{{ result_ipaserver_test.realm }}"
+      hostname: "{{ result_ipaserver_test.hostname }}"
+      setup_ca: "{{ result_ipaserver_test.setup_ca }}"
+
   - name: Install - Setup CA
     ipaserver_setup_ca:
       dm_password: "{{ ipadm_password }}"
@@ -245,12 +251,6 @@
       hostname: "{{ result_ipaserver_test.hostname }}"
       setup_ca: "{{ result_ipaserver_test.setup_ca }}"
 
-  - name: Install - Setup custodia
-    ipaserver_setup_custodia:
-      realm: "{{ result_ipaserver_test.realm }}"
-      hostname: "{{ result_ipaserver_test.hostname }}"
-      setup_ca: "{{ result_ipaserver_test.setup_ca }}"
-
   - name: Install - Setup HTTP
     ipaserver_setup_http:
       dm_password: "{{ ipadm_password }}"