AD: cross-domain membership fix
    
    A recent patch directed all call related to group membership lookups to
    the AD LDAP port to fix an issue related to missing group memberships in
    the Global Catalog. As a side-effect it broke cross-domain
    group-memberships because those cannot be resolved by the connection to
    the LDAP port.
    
    The patch tires to fix this by restoring the original behaviour in the
    top-level lookup calls in the AD provider and switching to the LDAP port
    only for the LDAP request which is expected to return the full group
    membership.
    
    Additionally this patch contains a related fix for the tokenGroups with
    Posix attributes patch. The original connection, typically a Global
    Catalog connection in the AD case is passed down the stack so that the
    group lookup after the tokenGroups request can run over the same
    connection.