krb5: Do not use unindexed objectCategory in a search filter
    
    Related:
    https://pagure.io/SSSD/sssd/issue/3968
    
    Since we switched to using objectcategory instead of objectclass for
    users and groups, the objectCategory attribute is also not indexed. This
    means that searches using this attribute must traverse the whole
    database which can be very slow.
    
    This patch uses the cn=users container instead of the full sysdb
    container as the search base which is more or less equivalent to using
    objectCategory=user anyway.
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    (cherry picked from commit e474c2dd305db654b42f2a123a6f60d12d7978c5)