(#17031) Adding domain users to local groups now works

As of 3.4.0, Puppet's windows group provider will support adding domain
users to local groups (as we already document). One side-effect of the new
implementation, is that you can specify either local or domain groups as
members of local groups, since group membership is expressed in terms of
SIDs, e.g. WinNT://<SID>.