ipa: remove SYSDB_USER_CERT from sub-domain users
    
    If there are no certificates returned for a sub-domain user from the IPA
    server to the client we should make sure they are not present in the
    client's cache anymore and remove the whole attribute from the cached
    user entry.
    
    Related to https://pagure.io/SSSD/sssd/issue/3603
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
    (cherry picked from commit 43003851129556acea15539a1dc0d4350d54cac8)