PAC: use SID instead of GID to search for groups
    
    With the support of POSIX IDs managed on the AD side we may find
    non-POSIX groups, i.e. groups which do not have a GID assigned in AD, in
    the PAC. Since in this case all cached groups have a SDI attribute it is
    more reliable to search the groups by SID instead of GID.