s3:passdb: add optional get_trusteddom_creds() hooks