trust: support retrieving POSIX IDs with one-way trust during trust-add
    
    With one-way trust we cannot rely on cross-realm TGT as there will be none.
    Thus, if we have AD administrator credentials we should reuse them.
    Additionally, such use should be done over Kerberos.
    
    Fixes:
     https://fedorahosted.org/freeipa/ticket/4960
     https://fedorahosted.org/freeipa/ticket/4959
    
    Reviewed-By: Tomas Babej <tbabej@redhat.com>