ipa-server-mode: add IPA group memberships to AD users
    
    When IPA trusts an AD domain the AD user or groups can be placed into
    IPA groups e.g. to put AD users under the control of HBAC. Since IPA
    group can only have members from the IPA directory tree and the AD users
    and groups are not stored there a special IPA object called external
    group was introduced. SIDs of users and groups can be added to the
    external group and since the external groups are in the IPA directory
    tree they can be member of IPA groups.
    
    To speed things up and to remove some load from the IPA servers SSSD
    reads all external groups and stores them in memory for some time before
    rereading the data.
    
    Enhances https://fedorahosted.org/sssd/ticket/1962