Cloned from: https://pagure.io/freeipa/issue/9948

Right now SELinux policy provided by FreeIPA only allows to run SSSD helpers `oidc_child` and `passkey_child` within `ipa_otpd_t` context. This assumes that they are launched by `ipa-otpd` daemon as part of the Kerberos TGT processing on IPA domain controller.

SSSD allows to authenticate with `oidc_child` and `passkey_child` on standalone deployments as well. We need to extend the SELinux policy to permit these usages.

Additionally, MIT Kerberos 1.22 in Fedora provides automated FAST channel acquisition on IPA enrolled clients. This requires any application using libkrb5 to get access to publicly available certificate data stored by IPA client. Extend SELinux policy to allow this access.