fedora-remote: minimal headless GNOME Remote Desktop host with Kanidm

New image built from upstream base-atomic (no desktop), adding only gnome-shell
+ gdm + gnome-remote-desktop + pipewire/portal + foot + Flatpak + Kanidm.
recommends=false to stay lean. Configures GNOME Remote Desktop headless remote
login on first boot (TLS + credentials + enable). Firefox preinstalled as a
per-user Flatpak. Add it to the CI matrix and prune both images.

images/fedora-remote/files/10-kanidm.conf

@@ -0,0 +1,16 @@
+# Fetch authorized SSH public keys from Kanidm (uploaded to the account).
+# Name this 10-* so it is read before systemd-userdbd's AuthorizedKeysCommand
+# drop-in, since sshd honours the first directive it sees.
+PubkeyAuthentication yes
+UsePAM yes
+AuthorizedKeysCommand /usr/bin/kanidm_ssh_authorizedkeys %u
+AuthorizedKeysCommandUser nobody
+
+# Hardening: key-only auth through Kanidm. Make sure you have uploaded an SSH
+# public key to your account before relying on this, or you can lock yourself
+# out of SSH.
+PermitRootLogin no
+PasswordAuthentication no
+PermitEmptyPasswords no
+GSSAPIAuthentication no
+KerberosAuthentication no