s4:auth_winbind: make sure we expand group memberships of the local domain