winbind: make sure we don't contact trusted domains via SAMR as AD DC