Define a principal specific for host enrollment instead of admin

[cmd-ntrf]

This PR replaces the FreeIPA admin credential used for host enrollment with a dedicated least-privileged host_enrollment account.

• Creates a non-login enrollment user with a generated encrypted password.
• Creates a dedicated role and privilege containing only permissions needed to add, enroll, and force-reenroll hosts.
• Uses the restricted principal with ipa-client-install --force-join.
• Publishes _mc-ipa-enrollment-ready.<domain> TXT "v1" after enrollment provisioning completes.
• Makes clients query the authoritative IPA DNS server for this marker instead of waiting for the ipa.<domain> HTTPS certificate.
• Stores the enrollment configuration in a standalone Python file.
• Documents that the readiness marker is a monotonic provisioning marker, not a live health check.

The marker assumes enrollment configuration remains valid for the lifetime of the FreeIPA deployment. Password-only changes and out-of-band changes are outside its scope.

[cmd-ntrf]

Successfully provisioned new clients and re-enrolled clients whose FreeIPA host records already existed. Both paths completed using the restricted enrollment principal.