Also fix some debug message levels

If the pointer stays around, zero it when it is freed, so we do not risk
access to released memory in case of bugs.

This adds a new option (offline_credentials_expiration) to the
[PAM] section of the sssd.conf

If the user does not perform an online authentication within the
timeout (in days), they will be denied auth once the timeout
passes.

In sssd only local is a native mpg domain, and it is forced.
All other providers will have to unroll mpg users into a user/group pair of
entries in the db. This allows the provider to automatically establish if
the remote server provides mpg users w/o possibily conflicting manual
configurations on the client trying to force an mpg behavior where none
is provided.

This reverts commit 8c50bd085c0efe5fde354deee2c8118887aae29d.

Amended: commit 1016af2b1b97ad4290ccce8fa462cc7e3c191b2e also made
use of the SYSLOG_ERROR() macro, so those portions of that code
also needed to be reverted.

This is just a band-aid until ELAPI is fully functional and ready to
use.

The code was still dependent on it for the ldap driver.
Changed the driver code to depend on the schema type.
Fix defaults for user and groups trees.
ATM if you use the rfc2307bis schema you have to put users and groups
in 2 separate trees (what people does by default anyway.
If this limitation will turn to be too hard, we will change this later.

The special persistent local database retains the original name.
All other backends now have their own cache-NAME.ldb file.

This patch reduces the time needed to enumerate groups of a midsized
domain from 12 seconds to 4.4
Optimizes enumerations by doing only 2 ldb searches and some ordering
instead of a number of searches proportional to the number of groups