Advertise the Key Connector to new SSO users

The clients only start the enrollment flow when the login response
contains KeyConnectorOption, which so far was only sent for users that
were already enrolled. Send it to every user without a master password
while the connector is enabled, so a freshly provisioned SSO user gets
enrolled instead of being asked to create a master password.

src/api/identity.rs

@@ -577,7 +577,9 @@ async fn authenticated_response(
         result["Key"] = Value::String(user.akey.clone());
     }
 
-    if uses_key_connector {
+    // Also advertised to users without a master password, that is how the client
+    // knows to enroll a new SSO user with the connector
+    if CONFIG.key_connector_enabled() && !has_master_password {
         result["UserDecryptionOptions"]["KeyConnectorOption"] =
             crate::api::core::key_connector::key_connector_user_decryption_option();
     }