responders: unify usage of sss_cmd_send_empty and _error
    
    Originally sss_cmd_send_empty() called also sss_cmd_done() to send
    an empty reply packet to the cliant where as sss_cmd_send_error()
    did not invoke this call and required the caller to call it manually.
    
    For this reason, a possible error in users_find_by_cert_done() was not
    send to the caller.
    
    This patch unifies the usage of those two functions in a way that both
    of them only creates the reply packet but do not send it. Another
    sss_cmd_done() call is required to send the reply.
    
    Because sss_cmd_done() is now always called, unit tests needed to be
    changed to always mock a value for __wrap_sss_cmd_done.
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/3151
    
    Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>