nsswitch: Add try_authok option to pam_winbind

[github at samba.org]

New comment by sathieu on Samba Github repository

https://github.com/samba-team/samba/pull/168#issuecomment-383092973
Comment:
I've tested that it works but please review carefully this code has no testsuite (I'm quite confident that my code doesn't change the behavior when the new option in not used) !

In particular (even before the patch):
- use_authtok implies use_first_pass
- I don't understand this:
```
                } else if (on(WINBIND_USE_AUTHTOK_ARG, ctrl)
                           && off(WINBIND__OLD_PASSWORD, ctrl)) {
                        return PAM_AUTHTOK_RECOVER_ERR;
                }
```