Support opendnssec 2.1.6
    
    The installation of IPA DNS server is using ods-ksmutil, but
    openddnssec 2.1.6 does not ship any more /usr/bin/ods-ksmutil. The tool
    is replaced by /usr/sbin/ods-enforcer and /usr/sbin/ods-enforcer-db-setup.
    
    The master branch currently supports fedora 30+, but fedora 30 and 31 are
    still shipping opendnssec 1.4 while fedora 32+ is shipping opendnssec 2.1.6.
    Because of this, the code needs to check at run-time if the ods-ksmutil
    command is available. If the file is missing, the code falls back to
    the new ods-enforcer and ods-enforcer-db-setup commands.
    
    This commit defines paths.ODS_ENFORCER and paths.ODS_ENFORCER_DB_SETUP
    for all platforms, but the commands are used only if ods-ksmutil is not found.
    
    Fixes: https://pagure.io/freeipa/issue/8214
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Christian Heimes <cheimes@redhat.com>