SDAP: Add return code ERR_ACCOUNT_LOCKED
    
    Add code to distinquish state when account is locked in Active
    Directory server.
    
    Tested against Windows Server 2012
    
    This patch is best effort only as decision whether account is actually
    locked is based on parsing error message returned by AD. The format and
    content of this error message might be subject of change in future
    releases and also can be modified by AD administrators.
    
    If account is locked bind operation is expected to return following
    error message:
    
    -----------------------------------------------------------------------
    Invalid credentials(49), 80090308: LdapErr: DSID-0C0903C5, comment:
    AcceptSecurityContext error, data 775, v23f0
    -----------------------------------------------------------------------
    
    Where sub string 'data 775' implies that account is locked
    (ERROR_ACCOUNT_LOCKED_OUT) [1]. However the 80090308 (error code
    0x80090308, SEC_E_INVALID_TOKEN) is the only guaranteed part of error
    string [2].
    
    Error message is described in further detail as [3]:
    -----------------------------------------------------------------------
    When the server fails an LDAP operation with an error, and the server
    has sufficient resources to compute a string value for the errorMessage
    field of the LDAPResult, it includes a string in the errorMessage field
    of the LDAPResult (see [RFC2251] section 4.1.10). The string contains
    further information about the error.
    
    The first eight characters of the errorMessage string are a 32-bit
    integer, expressed in hexadecimal. Where protocol specifies the extended
    error code "<unrestricted>" there is no restriction on the value of the
    32-bit integer.  It is recommended that implementations use a Windows
    error code for the 32-bit integer in this case in order to improve
    usability of the directory for clients.  Where protocol specifies an
    extended error code which is a Windows error code, the 32-bit integer is
    the specified Windows error code.  Any data after the eighth character
    is strictly informational and used only for debugging. Conformant
    implementations need not put any value beyond the eighth character of
    the errorMessage field.
    -----------------------------------------------------------------------
    
    [1] https://msdn.microsoft.com/en-us/library/windows/desktop/ms681386%28v=vs.85%29.aspx
    [2] https://social.msdn.microsoft.com/Forums/en-US/e1d600c8-60b7-4ed0-94cb-20ddd6c1a1c6/msadts-user-locking-password-policies?forum=os_windowsprotocols
    [3] MS-ADTS 3.1.1.3.1.9
        https://msdn.microsoft.com/en-us/library/cc223253.aspx
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/2839
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
    Reviewed-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
    (cherry picked from commit ff275f4c0b8cc1a098dbd0c5f6d52d6a93cda597)