otpd: forward Access-Challenge

[pbrezina]

Radius server can reply with Access-Challenge response which may ask for more information in Reply-Message attribute. The request is identified with the State attribute.

[abbra]

TODO, mostly for test cases:

• [ ] add a basic RADIUS test server, using pyrad library (packaged in COPR abbra/oauth2)
• [ ] add a flag to OTP config string payload, to enable a challenge through the RADIUS server before sending a request to Kerberos client (see https://marc.info/?t=162315320000001&r=1&w=2 for the discussion), the flag would be triggered if the user entry has IdP link associated (see https://github.com/abbra/freeipa/blob/external-idp/doc/designs/external-idp/idp-api.md for details)
• [ ] implement a RADIUS server side test that responds with the Access-Challenge for a specific username with a pre-defined challenge message and a response code
• [ ] add a test that defines an IdP link for this user, sends a RADIUS request to ipa-otpd for the user, ensures ipa-otpd responds with the Access-Challenge message that sends back the same challenge we defined in the previous step
• [ ] finally, add a RADIUS test that sends a RADIUS message back to ipa-otpd, containing the state from Access-Challenge and a response ('OTP code') as if responded by krb5 KDC. Ensure RADIUS test server returns success. Do the same for a negative test.

[pbrezina]

We don't need to support Access-Challenge in RADIUS proxy mode. This is not needed for production, closing.