LDAP/AD: resolve domain local groups for remote users
    
    If a user from a trusted domain in the same forest is a direct or
    indirect member of domain local groups from the local domain those
    memberships must be resolved as well. Since those domain local groups
    are not valid in the trusted domain a DC from the trusted domain which
    is used to lookup the user data is not aware of them. As a consequence
    those memberships must be resolved against a local DC in a second step.
    
    Resolves https://fedorahosted.org/sssd/ticket/3206
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>