During system upgrades, Fedora systems avoid bringing up the network, and in general we've seen in other cases that there may be issues running upgrade scripts while bits are being laid down on the disk.

We should think if the upgrade scripts should instead be run at ipa service startup. This could be reasonably easily be done with a pre-exec script in the ipa service unit, or by having an ipa-upgrade service unit as a dependency and blocking service for other ipa services.

Besides avoiding issue during system upgrades, the advantage is that we can recover from an ipa upgrade transient issue simply by restartgin the ipa service, and, on fatal errors stop the ipa service from starting entirely.

Inspired by: https://bugzilla.redhat.com/show_bug.cgi?id=1452866