Modify behavior of pam_pwd_expiration_warning
    
    New option pwd_expiration_warning is introduced which can be set per
    domain and can override the value specified by the original
    pam_pwd_expiration_warning.
    
    If the value of expiration warning is set to zero, the filter isn't
    apllied at all - if backend server returns the warning, it will be
    automatically displayed.
    
    Default value for Kerberos: 7 days
    Default value for LDAP: don't apply the filter
    
    Technical note: default value when creating the domain is -1. This is
    important so we can distinguish between "no value set" and 0. Without
    this possibility it would be impossible to set different values for LDAP
    and Kerberos provider.