Fix OTP validation in FIPS mode
    
    NSS doesn't allow keys to be loaded directly in FIPS mode. To work around
    this, we encrypt the input key using an ephemeral key and then unwrap the
    encrypted key.
    
    https://pagure.io/freeipa/issue/7168
    
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>