ad: use GSSAPI with LDAPS
    
    There is an issue in some cyrus-sasl versions with a max SSF of 0 (zero)
    is not handled correctly when using GSS-SPNEGO. To be on the safe side
    we switch to GSSAPI in that case.
    
    Related to https://pagure.io/SSSD/sssd/issue/4007
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>