(#17031) Adding domain users to local groups now works

As of 3.4.x, Puppet's windows group provider will support adding domain
users to local groups (as we already document). One side-effect of the new
implementation, is that you can specify either local or domain groups as
members of local groups, since group membership is expressed in terms of
SIDs.