ad_account_can_shortcut: shortcut if ID is unknown
    
    If sss_idmap_unix_to_sid() returns an error we can assume that the given
    POSIX ID is not from the current domain and can be skipped. This is e.g.
    the case in the IPA provider if a POSIX ID used in the IPA domain is
    checked in a trusted id-mapped AD domain before the IPA domain is
    checked.
    
    Resolves https://pagure.io/SSSD/sssd/issue/3452
    
    Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>