Added command `knife opc user password`.

Command either updates the password for a user or, if --enable_external_auth is passed instead of a password, it will enable ldap for that user.
Yep, that's what recovery_authentication_enabled does. Overrides LDAP login in favor of Chef login if LDAP is in use.

1. Currently, yes. I also feel that is odd, but the reason I did it that way is I am following the original behavior of `private-chef-ctl password`. That situation (where LDAP breaks, you set a password and recover, and it breaks again), is the only time you wouldn't want to (re)set a password when wanting to set a user in recovery mode, but if its frequent enough, maybe we should update the behavior of both this PR and `chef-server-ctl password` to be able to put a user in recovery mode without resetting password. Maybe add a `--disable-ldap` or similar flag? Not sure if the use case occurs enough to merit the change in behavior, but you are in a better position than I to judge that honestly.

2. Nope, every user starts with `recovery_authentication_enabled` set to true in the db. It is only ever not true if LDAP is enabled.