NSS: use different neg cache name for UPN searches
    
    If Kerberos principals or email address have the same domain suffix as
    the domain itself the first user lookup by name might have already added
    the name to the negative cache and the second lookup by UPN/email will
    skip the domain because of the neg cache entry. To avoid this a special
    name with a '@' prefix is used here.
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>