s4:server: avoid calling into nss_winbind from within 'samba'