ipa-kdb: do not remove keys for hardened auth-enabled users
    
    Since 5d51ae5, principal keys were dropped in case user auth indicator
    was not including password. Thereafter, the key removal behavior was
    removed by 15ff9c8 in the context of the kdcpolicy plugin introduction.
    Support for hardened pre-auth methods (FAST and SPAKE) was added in
    d057040, and the removal of principal keys was restored afterwards by
    f0d12b7, but not taking the new hardened auth indicator into account.
    
    Fixes: https://pagure.io/freeipa/issue/9065
    Related to: https://pagure.io/freeipa/issue/8001
    
    Signed-off-by: Julien Rische <jrische@redhat.com>
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Francisco Trivino <ftrivino@redhat.com>