SDAP: Add sdap_has_deref_support_ex()
    
    Related:
    https://pagure.io/SSSD/sssd/issue/3979
    
    In some cases, it makes sense for performance reasons to disable
    dereference when processing user groups. But since processing of HBAC host
    groups is not much of a performance sensitive operation, we can get away
    with ignoring the client side setting and always using the dereference
    branch if the server supports the dereference call.
    
    This patch extends the sdap_has_deref_support call with a flag that
    allows the caller to bypass the client side check.
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    (cherry picked from commit 1eb3ae1c46314ccc9151dc271966584b3d0f39f5)