Add (free)ipa-server-encrypted-dns package to images where available in distribution.

[adelton]

Resolves #674.

Due to https://access.redhat.com/solutions/7125998, we currently cannot test the behaviour on RHELs, so not ready to merge until that gets resolved.

[adelton]

The RHEL installation issues were resolved.

However, when testing these options for example with https://github.com/adelton/freeipa-container/actions/runs/15817377869/job/44578869951, we see the setup failing with

  File "/usr/lib/python3.12/site-packages/ipaserver/install/server/__init__.py", line 654, in main
    master_install(self)
  File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 278, in decorated
    func(installer)
  File "/usr/lib/python3.12/site-packages/ipaserver/install/server/install.py", line 1020, in install
    dns.install(False, False, options)
  File "/usr/lib/python3.12/site-packages/ipaserver/install/dns.py", line 465, in install
    _setup_dns_over_tls(options)
  File "/usr/lib/python3.12/site-packages/ipaserver/install/dns.py", line 176, in _setup_dns_over_tls
    with open(paths.RESOLV_CONF, 'w') as f:
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

2025-06-23T07:05:06Z DEBUG The ipa-server-install command failed, exception: OSError: [Errno 30] Read-only file system: '/etc/resolv.conf'
2025-06-23T07:05:06Z ERROR [Errno 30] Read-only file system: '/etc/resolv.conf'

It seems to be caused by https://github.com/freeipa/freeipa/blob/master/ipaserver/install/dns.py#L168-L178 which insists on rewriting /etc/resolv.conf even if it already contains nameserver 127.0.0.1 (we use docker/podman run option --dns=127.0.0.1).

So it looks like the FreeIPA code will have to be changed first not to fail in situations where /etc/resolv.conf is read-only (and already contains the desired values).

[adelton]

I've now filed https://pagure.io/freeipa/issue/9813 to get opinion from the FreeIPA folks.