Reconfigure BMC to authenticate against a RADIUS Server

[majst01]

Currently a malicious user could remove one of our crucial BMC users with inband IPMI access. This would lead to a machine which will not be manageable by metal-bmc anymore.

We could prevent this if we authenticate the BMC against a RADIUS Server, at least for a user which is used by metal-bmc to manage the server.

All Supermicro BMCs can authenticate against RADIUS, and this configuration can be set via Redfish. We should do this for every BMC in a reconcilation loop. The go-hal library should get the required Interface to Get/Set the Radius authentication.

The RADIUS Server must be reachable in the VLAN 4000, alongside metal-bmc, this could either achieved by deploying a freeradius container on the management server, or metal-bmc acts as radius server as well. This is quite easy see here: https://github.com/layeh/radius#server-example.

The Radius Server endpoint should be presented from both management servers on the same IP address and some sort of loadbalancing, either with ECMP or a haproxy deployment, because the BMC can only have one Radius server defined.