If USN attribute is not present, we call strdup on uninitialized
variable. This may cause segfault, or if we are lucky and
usn is NULL it will return ENOMEM.

Resolves:
https://fedorahosted.org/sssd/ticket/2052

With the support of POSIX IDs managed on the AD side we may find
non-POSIX groups, i.e. groups which do not have a GID assigned in AD, in
the PAC. Since in this case all cached groups have a SDI attribute it is
more reliable to search the groups by SID instead of GID.

When processing a list of groups we try to process as much as possible
only not stop on the first error.

To avoid issues with case-sensitivity it is more reliable to search the
user entry in the cache and use the returned DN instead of constructing
it.

Since the DN of the group is used to remove a membership it is not
necessary to check if the GID is valid.

If the user entry does not exist in the cache and a primary GID cannot
be found it does not make sense to create a user entry.

Currently the PAC responder deletes a user entry and recreates it if
some attributes seems to be different.

Two of the attributes where the home directory and the shell of the
user. Those two attributes are not available from the PAC but where
generates by the PAC responder. The corresponding ID provider might have
better means to determine those attributes, e.g. read them from LDAP, so
we shouldn't change them here.

The third attribute is the user name. Since the PAC responder does
lookups only based on the UID we can wait until the ID provider updates
the entry.

Fixes https://fedorahosted.org/sssd/ticket/1996

Adds pac_cli be_client structure pointer, to indetify and log the PAC
responder termination correctly.