Do not save HBAC rules in subdomain subtree
    
    Currently the sysdb context is pointed to the subdomain subtree
    containing user the user to be checked at the beginning of a HBAC
    request. As a result all HBAC rules and related data is save in the
    subdomain tree as well. But since the HBAC rules of the configured
    domain apply to all users it is sufficient to save them once in the
    subtree of the configured domain.
    
    Since most of the sysdb operations during a HBAC request are related to
    the HBAC rules and related data this patch does not change the default
    sysdb context but only create a special context to look up subdomain
    users.