ipa: use only the global catalog service of the forest root
    
    While creating the domains and sub-domains each domain gets a global
    catalog services assigned but only one should be used because the global
    catalog is by definition responsible for the whole forest so it does not
    make sense to use a global catalog service for each domain and in the
    worst case connect to the same GC multiple times.
    
    In the AD provider this is simple because the GC service of the
    configured domain AD_GC_SERVICE_NAME ("AD_GC") can be used. In the IPA
    case all domains from the trusted forest are on the level of sub-domains
    so we have to pick one. Since the forest root is linked from all domain
    of the same forest it will be the most straight forward choice.
    
    Related to https://pagure.io/SSSD/sssd/issue/3902
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>