ipa/client: repair nsswitch.conf post-FAS
    
    The `fas_client` role installed a version of nsswitch.conf which doesn't
    delegate to sss. For some reason, ipa-client-install doesn't ensure this
    is brought back. This prepends `sss` to lines where it would be missing
    otherwise. Also, run the cleanup tasks before the enrollment task.
    
    Signed-off-by: Nils Philippsen <nils@redhat.com>