LDAP: Disable token groups by default
    
    We tried to speed up processing of initgroup lookups with tokenGroups even for
    the LDAP provider (if remote server is Active Directory), but it turns out that
    there are too many corner cases that we didn't catch during development that
    break. For instance, groups from other trusted domains might appear in TG and
    the LDAP provider isn't equipped to handle them.
    
    Overall, users who wish to use the added speed benefits of tokenGroups are
    advised to use the AD provider.
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/2483
    
    Reviewed-by: Michal Židek <mzidek@redhat.com>