sudorule-add-user: allow to reference users and groups from trusted domains directly
    
    Allow specifying AD users and groups from trusted Active Directory
    forests in `ipa sudorule-add/remove-user` family of commands.
    
    SSSD uses single attribute 'externalUser' for IPA to pull 'external'
    objects referenced in SUDO rules. This means both users and groups are
    represented within the same attribute, with groups prefixed with '%',
    as described in sudoers(5) man page.
    
    Add member type validators to 'ipa sudorule-add/remove-user' family
    commands and rely on member type validators from 'idviews' plugin to
    resolve trusted objects.
    
    Referencing fully qualified names for users and groups from trusted
    Active Directory domains in 'externalUser' attribute of SUDO rules is
    supported in SSSD 2.4 or later.
    
    RN: IPA now supports adding users and groups from trusted Active
    RN: Directory domains in SUDO rules without an intermediate non-POSIX
    RN: group membership
    
    Fixes: https://pagure.io/freeipa/issue/3226
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Christian Heimes <cheimes@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>