AD: filter domain local groups for trusted/sub domains
    
    In Active Directory groups with a domain local scope should only be used
    inside of the specific domain. Since SSSD read the group memberships
    from LDAP server of the user's domain the domain local groups are
    included in the LDAP result. Those groups should be filtered out if the
    domain is a sub/trusted domain, i.e. is not the domain the client
    running SSSD is joined to.
    
    The groups will still be in the cache but marked as non-POSIX groups and
    no GID will be assigned.
    
    Fixes https://fedorahosted.org/sssd/ticket/2178