[breaking] Configure ssd in a “Winbind-friendly” way

This is necessary for Samba versions 4.8 and above to work (and doesn't hurt for the others).

• Rather than having sssd configured as a pair of Kerberos and LDAP clients that happen to talk to the same server, let it know that it is talking to AD
• This results in life being slightly less miserable for Samba users, who can use idmap_sss and keep centralized UIDs and GIDs for the time being. (Just so you know, Microsoft is about to kick that ladder from under us.)
• While we are feeling magnanimous, give them an smb.conf snippet to chew on.