ipa: support disabled domains
IPA does not disable domains with the help of a flag in the domain
objects but more general with the help of the SID blacklist. With this
patch the blacklist is read with other data about trusted domains and if
the domain SID of a trusted domain is found the domain is disabled. As a
result uses and groups from this domain cannot be looked up anymore.
Related to https://pagure.io/SSSD/sssd/issue/4078
Reviewed-by: Pavel Březina <pbrezina@redhat.com>