Improve how the decision to trigger user enrollment during automated provisioning is made

[wojcik91]

• at the moment in automated scenarios (deep link or initial provisioning) we make the decision about whether to trigger the enrollment process based on the value of enrolled property of the User object that comes in a response from core
• users synced from AD/LDAP are marked as enrolled after being synced, even if they haven't yet logged into Defguard and configured any MFA methods
• we need to figure out a better way to check if we have to proceed with enrollment for users synced from AD