Make sure that it is possible to use FreeIPA installation and management tools without passwords.

Two major areas:

• With LDAPI we configure autobind to LDAP, this means cn=Directory Manager administrator account can be left without any password, this means we can change all tools which rely on LDAPI to avoid asking DM's password

• IPA client installer needs to recognize and enforce use of FAST for OTP, IdP, or passkey methods for enrollment account. Use Anonymous PKINIT for the FAST armor

Additionally, we need to update both IPA CLI tools and Web UI login to handle non-password-based login. IPA CLI already relies on existing Kerberos ticket but adding a smarter recognition of missing Kerberos ticket and probing for FAST armor + a method to use and use it as in IPA client installer would help people to operate in passwordless setup.

For Web UI there is already a separate ticket to add OIDC-based end-point and Web UI login 'portal'.