nss_ldap security and bug fix update

[253-5]

• build with strict-aliasing disabled, because pam_ldap breaks strict-aliasing
  rules without it (tools)
  [253-4]
• block SIGPIPE in the atfork handler, so that it doesnt trip up when
  attempting to drop a connection to the server (#448833)
  [253-3]
• add patch to make netgroup enumeration fail due to lack of entries in
  setnetgrent(), rather than in getnetgrent(), to match how other mechanisms
  work (Jose Plans, #253997)
  [253-2]
• add fix for not double-freeing the result list when we try to initialize an
  internal enumeration context while we have one active (#233382)
  [253-1]
• rebase to nss_ldap 253 (#401731)
  • fixes leftover lock problem in nss_initgroups_ignoreusers handling (#429101)
  • fixes re-use of connections across fork() (#155187)