ipa-kdb: validate that an OTP user has tokens
    
    This handles the case where a user is configured for OTP in ipaUserAuthType,
    but the user has not yet created any tokens. Until the user creates tokens,
    the user should still be able to log in via password. This logic already
    exists in LDAP, but ipa-kdb needs to perform the same validation to know
    what data to return to the KDC.
    
    https://fedorahosted.org/freeipa/ticket/4154
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>