Enable GSSAPI/SPNEGO authentication if samba role is ADS. Refs #1987

Kerberos setup relies on [[nethserver-samba]] smbads script: added
KrbStatus and KrbPrimaryList props to squid key.  Environment vars are
set in /etc/sysconfig/squid template.  Requires squid >= 3.3.10
Create kerberos keytab if machine has samba ADS role. Refs #2407 #1987
Use LDAP helper for BASIC authentication method. Refs #1987

Reload squid daemon on password-modify and user lock/unlock events to
invalidate credentials cache (TTL set to 1 hour).
Use squid NTLM helper, if we have samba in PDC role. Refs #1987