ipa/client: Revamp combining shell groups
    
    The previous implementation didn't work because of a chicken-and-egg
    problem: To add the batcave shell groups to those specifically for
    bastion, it needs to look them up, but they aren't set yet (probably
    because `batcave` comes after `bastion`).
    
    Now, one can (optionally) set `ipa_client_shell_groups_inherit_from`, a
    list of Ansible group names whose `ipa_client_shell_groups` will be
    combined with that of the host itself. This is more robust because it's
    done late, after variables are set from the inventory.
    
    Signed-off-by: Nils Philippsen <nils@redhat.com>