feat: configurable host UEFI password management during enrollment

[martinraumann]

Is this a new feature, an enhancement, or a change to existing functionality?

New Feature

How would you describe the priority of this feature request

Medium

Please provide a clear description of problem this feature solves

NICo currently sets a site-wide Host UEFI password during enrollment. Some operators need NICo to manage the host lifecycle and boot configuration while leaving host UEFI password ownership to their existing security or platform process.

There is no supported way to opt out during enrollment. bmc_retain_credentials applies only to BMC credential rotation. Clearing the password after enrollment is not a documented replacement because NICo still sets the password and performs the related lifecycle actions first.

Feature Description

As an infrastructure operator, I want a supported policy to disable NICo-managed Host UEFI password setup for selected hosts or a site, so that NICo can manage supported lifecycle operations without taking ownership of firmware password management.

Describe your ideal solution

Add a security-reviewed, declarative Host UEFI password-management policy with these properties:

• Default behavior remains unchanged: NICo manages the Host UEFI password.
• An explicit per-site or per-host opt-out skips Host UEFI password setup and rotation during enrollment.
• NICo continues supported BMC/Redfish lifecycle operations, including boot-order configuration, using BMC credentials.
• The policy is visible in the API/CLI and audit logs.
• Documentation defines security implications, supported hardware, and any operations unavailable when UEFI password management is disabled.

Describe any alternatives you have considered

• Clear the UEFI password after enrollment. This still sets the password first and is not documented as a supported operating model.
• Use bmc_retain_credentials. This only affects BMC credentials, not Host UEFI password setup.
• Maintain a custom post-enrollment automation. This creates an unsupported lifecycle divergence.

Additional context

This changes the current Host UEFI setup path in the machine-controller enrollment state machine. The request is for an explicit supported policy, not a workaround that bypasses security controls.

Code of Conduct

• I agree to follow NVIDIA Infra Controller's Code of Conduct
• I have searched the open feature requests and have found no duplicates for this feature request