Fix up a security issue with the way we handle domain groups retuned on the

Fix up a security issue with the way we handle domain groups retuned on the
info3.  These are RIDs, and it only makes sense to combine them with the domain
SID returned with them.  This is important for trusted domains, where that sid
might be other than the one we currently reterive from the secrets.tdb.

Also remove the become_root()/unbecome_root() wrapper from around both
remaining TDB users:  Both are now initialised at smbd startup.

Andrew Bartlett