ad-auth: improve sssd's pam config for offline use

ad-auth/templates/sssd.conf.j2

@@ -3,6 +3,11 @@ domains = {{ domain }}
 config_file_version = 2
 services = nss, pam
 
+[pam]
+offline_credentials_expiration = 1
+offline_failed_login_attempts = 3
+offline_failed_login_delay = 0
+
 [domain/{{ domain }}]
 ad_domain = {{ domain }}
 krb5_realm = {{ domain.upper() }}