nss: use negative cache for sid-by-id requests
    
    Since requests by ID are not assized to a specific domain SSSD might
    check the ID in domains where the ID does not exists even if the ID is
    already in the sysdb cache of the right domain. For requests where
    already a memory cache is available like e.g. getpwuid() and getgrgid()
    this has no negative impact because the requests are answered directly
    from the cache most of the time without hitting SSSD. As long as there
    is no use-case which does not use the memory cache those requests do not
    need an update.
    
    But for request like sid-by-id where currently no memory cache is
    available there are quite some additional costs especially for trusted
    domains.
    
    Resolves https://fedorahosted.org/sssd/ticket/2731
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>