sudo smart refresh: do not include usn in filter if no valid usn is known
    
    https://fedorahosted.org/sssd/ticket/1736
    
    When there are no rules during first refresh, we don't have valid
    USN value. We use 0 in this case, but it turned out that OpenLDAP
    takes it as invalid time format (if modifyTimestamp is used instead
    of USN) and thus returns no records.
    
    Now we don't include USN/modifyTimestamp attribute in the filter
    if such situasion occurs.