sudo: always use server highest known usn for smart refresh
    
    The sudo attributes may not be indexed on the server, therefore if
    smart refresh filter is run on the server it may first search using
    the indexed entryusn attribute and run the rest of the filter on
    non-sudo objects. The number of objects that are filtered may increased
    dramatically if sudo rules are not changed for a long time (and thus
    keeping smaller and smaller last sudo usn number).
    
    This patch makes sure that highest sudo usn number is always set to
    the highest server usn number known by SSSD after each refresh.
    
    Resolves:
    https://pagure.io/SSSD/sssd/issue/3997
    
    Reviewed-by: Sumit Bose <sbose@redhat.com>