v0.5.0

Account lifecycle and access: stage users, lockout status and unlock,
password policy, subordinate IDs, HBAC and sudo rules with hbactest,
passkey mappings and OTP token sync, each with a Context twin and an
ipatest model. Every behaviour is checked against real FreeIPA 4.9,
4.12 and 4.13 by the contract tests.

• Stage users: StageUserAdd, StageUserShow, StageUserFind,
  StageUserMod, StageUserActivate and StageUserDelete
• Lockout: UserStatus returns one ReplicaStatus per master (failed
  logins in either of FreeIPA's forms, last success and failure times, an
  unreachable master reported instead of failing the call); UserUnlock
• Password policy: PwPolicyShow and UserPwPolicy, with durations as
  time.Duration and the FreeIPA 4.13 password-quality credits and grace
  login limit
• Subordinate IDs: SubIDFind and SubIDGenerate
• HBAC and sudo: HBACRuleFind, SudoRuleFind and HBACTest, which
  reads hbactest's result correctly and evaluates every rule, not only the
  first 100
• Passkeys: UserAddPasskey and UserRemovePasskey
• SyncOTPToken and ErrInvalidCredentials (based on ubccr/goipa#2 by
  @farzandalaee)
• CodeOption (3005 OptionError: an option the command does not take)
• ipatest models stage users, user_status and user_unlock, password
  policies, sub-IDs, HBAC and sudo rules (with the default allow_all
  rule), hbactest, passkey mappings and token sync