WIP: service: add support for interactive connect
Make openfortivpn invoke a pinentry-compatible helper that proxies the password requests back to the daemon.
Also, defer OTP from NeedSecrets() for interactive connection. Otherwise we're asking too early for poor souls who get OTP via SMS only once they initiated the authentication and supplied the password.