ipa-kdb: Set the 'otp' user string if OTP is enabled.

Since it is not secure to send radius configuration information
over krb5 user strings, we simply set the string with no value
and let otp be forwarded to the default location.

For more details, see:
  http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS
Add the krb5/FreeIPA RADIUS companion daemon.

This daemon listens for RADIUS packets on a well known
UNIX domain socket. When a packet is received, it queries
LDAP to see if the user is configured for RADIUS authentication.
If so, then the packet is forwarded to the 3rd party RADIUS server.
Otherwise, a bind is attempted against the LDAP server.

For more details, see:
  http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS