SDAP: Add sdap_has_deref_support_ex()
    
    Related:
    https://pagure.io/SSSD/sssd/issue/3979
    
    In some cases, it makes sense for performance reasons to disable
    dereference when processing user groups. But since processing of HBAC host
    groups is not much of a performance sensitive operation, we can get away
    with ignoring the client side setting and always using the dereference
    branch if the server supports the dereference call.
    
    This patch extends the sdap_has_deref_support call with a flag that
    allows the caller to bypass the client side check.
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>