ipa: filter IPA users from extdom lookups by certificate
    
    The extdom lookup by certificate will return the names of all matching
    users, both from the IPA and trusted domains. The IPA users from the
    list should not be looked up via the extdom plugin because they are
    already lookup up directly. Additionally the lookup might fail and cause
    an error which might prevent that the remaining users from the list are
    looked up.
    
    Resolves https://pagure.io/SSSD/sssd/issue/3407
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>