Since trusted domain users do not exist in the LDAP tree, their authentication
is handed over to PAM stack with the hope that PAM is set up properly to
authenticate them.

Additionally, this patch completely refactors authentication for the original DNs
that *are* located in the LDAP tree. Previous way to handle it was through
referrals being sent back. However, this method does not work at all.

Instead, we set SLAPI_BIND_TARGET_DN to the entry's original DN and hand over
pre-bind processing to other directory server's plugins. If slapi-nis set up
with a higher precedence to them, authentication will be handled by others.

Schema-compat plugin can be configured to serve users and groups through the
plugin configuration entry in directory server:

schema-compat-lookup-nsswitch: <user|group>
schema-compat-nsswitch-min-id: <value>

Separate trees should be configured to look up users and groups.
If minimal id value is missing, it will default to 1000.

src/back-sch-pam.c implements PAM authentication for users not found in the LDAP tree
using system-auth system service when running on FreeIPA master server.

src/back-sch-nss.c implements interface to query users and groups on FreeIPA
master server via getpwnam_r(), getgrnam_r(), and libsss_idmap.

When one instance of schema compat plugin is configured to consult NSSWITCH,
promote its configuration to the backend.

Default to not looking into NSSWITCH.

NSSWITCH supporting code needs access to the schema-compat structures

format_strdupbv() helper is handy when you need to store a string
value off the BER value.

PAM stack requires exclusive access, therefore we need to use a write lock.

Required for authenticating synthetically created records coming outside
of LDAP store.

Add %sort(), which binary-sorts a single list of values, and
%dribble_merge(), which takes a quoted length, a separator,
and some expressions and produces a list of lists of values
using the separator, where no list is larger than the length.