re-added "winbind:ignore domains" patch

re-added "winbind:ignore domains" patch

This option really is essential, as we discover again and again at
customer sites. Due to bugs in winbind some domains are toxic. When
you are installing at a site and a particular domain in a complex
setup causes winbind to segfault or hang then you need a way to
disable that domain and continue.

In an ideal world winbind could handle arbitrarily complex ADS
domains, but we are nowhere near that yet. If we ever get to that
stage then we won't need this option.
(cherry picked from commit 41898a42c1ad7d382088799a6e3f712583808d20)