PAM/KRB5: optional otp and password prompting
    
    Depending on the available Kerberos pre-authentication methods pam_sss
    will prompt the user for a password, 2 authentication factors or both.
    
    Resolves https://fedorahosted.org/sssd/ticket/2988
    
    Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com>
    Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>