adtrust: support UPNs for trusted domain users
    
    Add support for additional user name principal suffixes from
    trusted Active Directory forests. UPN suffixes are property
    of the forest and as such are associated with the forest root
    domain.
    
    FreeIPA stores UPN suffixes as ipaNTAdditionalSuffixes multi-valued
    attribute of ipaNTTrustedDomain object class.
    
    In order to look up UPN suffixes, netr_DsRGetForestTrustInformation
    LSA RPC call is used instead of netr_DsrEnumerateDomainTrusts.
    
    For more details on UPN and naming in Active Directory see
    https://technet.microsoft.com/en-us/library/cc739093%28v=ws.10%29.aspx
    
    https://fedorahosted.org/freeipa/ticket/5354
    
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>