Add vetoed_shells option
    
    There may be users in LDAP that have a valid but unwelcome shell
    set in their account. This adds a blacklist of shells that should
    always be replaced by the fallback_shell.
    
    Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>