s4:dsdb/password_hash: reject interdomain trust password changes via LDAP