Add config option for RSA key size for HTTP, DS, PKINIT, RA certs

A new command-line option was added, --key-type-size, to define
the type of key to generate and the size of the key, or equivalent.

Only rsa is supported currently but this can be expanded easily if
additional key types are added. Placeholders have been added for
ec and ml-dsa key types but they are not yet supported.

There is also a config plugin option to modify this value. It does
NOT modify any certificates already issued. Changing it will only
apply to new replicas added.

Related: https://pagure.io/freeipa/issue/9738

Also add a test to verify installation key sizes.

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
Reviewed-By: Thomas Woerner <twoerner@redhat.com>

API.txt

@@ -1076,7 +1076,7 @@ args: 0,1,1
 option: Str('version?')
 output: Output('result')
 command: config_mod/1
-args: 0,32,3
+args: 0,33,3
 option: Flag('add_sids?', autofill=True, default=False)
 option: Str('addattr*', cli_name='addattr')
 option: Flag('all', autofill=True, cli_name='all', default=False)
@@ -1100,6 +1100,7 @@ option: Int('ipasearchrecordslimit?', autofill=False, cli_name='searchrecordslim
 option: Int('ipasearchtimelimit?', autofill=False, cli_name='searchtimelimit')
 option: Str('ipaselinuxusermapdefault?', autofill=False)
 option: Str('ipaselinuxusermaporder?', autofill=False)
+option: Str('ipaservicekeytypesize?', autofill=False, cli_name='key_type_size')
 option: StrEnum('ipauserauthtype*', autofill=False, cli_name='user_auth_type', values=[u'password', u'radius', u'otp', u'pkinit', u'hardened', u'idp', u'passkey', u'disabled'])
 option: Bool('ipauserdefaultsubordinateid?', autofill=False, cli_name='user_default_subid')
 option: Str('ipauserobjectclasses*', autofill=False, cli_name='userobjectclasses')