ipa-kdb: Add OTP support
    
    If OTP is enabled for a user, then:
      1. Long-term keys are not provided to KDB
      2. The user string 'otp' is defined to KDB
    
    Since it is not secure to send radius configuration information
    over krb5 user strings, we simply set the string to a known default
    ('[]') which enables the default configuration in the KDC.
    
    https://fedorahosted.org/freeipa/ticket/3561
    http://freeipa.org/page/V3/OTP