Improve how the decision to trigger user enrollment during automated provisioning is made

[wojcik91]

• at the moment in automated scenarios (deep link or initial provisioning) we make the decision about whether to trigger the enrollment process based on the value of enrolled property of the User object that comes in a response from core
• users synced from AD/LDAP are marked as enrolled after being synced, even if they haven't yet logged into Defguard and configured any MFA methods
• we need to figure out a better way to check if we have to proceed with enrollment for users synced from AD

The solution as discussed:

• Add a flag to User object
• Set the flag when admin uses start_enrollment endpoint to generate a token for the user
• Take the flag into account when calculating the User::enolled property
• Unset the flag once the user finishes the enrollment process