pa-getkeytab is a help process which might even get called during
the startup of SSSD. Hence it should not try to use any SSSD responder
especially not the NSS responder.

Typically we call helpers with the environment of the calling SSSD
component where then _SSS_LOOPS environment variable is set to 'NO' to
skip calls to SSSD in libnss_sss. Since we have to set the KRB5CCNAME
environment variable to the ccache with the current TGT for the host
principal when calling ipa-getkeytab execle() is used to call
ipa_getkeytab which unfortunately replaces the environment of the caller
with the one provided in the last argument of the call. To make sure
ipa_getkeytab does not call back into SSSD we have to set _SSS_LOOPS=NO
here as well.