samba-tool: validate password early in `domain provision`