krb5: do not send pac for IPA users from the local domain
    
    So far we didn't send the PAC of IPA users to the PAC responder during
    password authentication because group memberships for IPA users can be
    retrieved efficiently with LDAP calls. Recently patches added PAC
    support for the AD provider as well and removed the restriction for the
    IPA users. This patch restores the original behaviour by introducing a
    new flag in struct krb5_ctx which is only set for the IPA provider.
    Additionally a different flag is renamed to make it's purpose more
    clear.
    
    Fixes https://fedorahosted.org/sssd/ticket/1995