[SSSD] IPA migration fixes

[Jakub Hrozek]

https://fedorahosted.org/sssd/ticket/924 started as a segfault ticket
but we could never reproduce the crash afterwards.

As Sumit noted it might have been caused by setting the O_NONBLOCK flag
twice. However, the changes Sumit proposed in the ticket still make
sense because they provide much cleaner solution.

Attached are two patches:

[PATCH 1/2] Provide means of forcing TLS and GSSAPI enabled/disabled
for sdap connections

This will be used to force TLS on the auth connection only and allow
staying on GSSAPI-backed ID connection for the rest of the request.

[PATCH 2/2] IPA migration fixes
* use the id connection for looking up the migration flag
* force TLS on the password based authentication connection