adtrust: define Guests mapping after creating cifs/ principal
    
    All Samba utilities load passdb modules from the configuration file. As
    result, 'net groupmap' call would try to initialize ipasam passdb module
    and that one would try to connect to LDAP using Kerberos authentication.
    
    We should be running it after cifs/ principal is actually created in
    ipa-adtrust-install or otherwise setting up group mapping will fail.
    
    This only affects new installations. For older ones 'net groupmap' would
    work just fine because adtrust is already configured and all principals
    exist already.
    
    A re-run of 'ipa-server-upgrade' is a workaround too but better to fix
    the initial setup.
    
    Related: https://pagure.io/freeipa/issue/7705
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>