ipa: remove SYSDB_USER_CERT from sub-domain users
If there are no certificates returned for a sub-domain user from the IPA
server to the client we should make sure they are not present in the
client's cache anymore and remove the whole attribute from the cached
user entry.
Related to https://pagure.io/SSSD/sssd/issue/3603
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
(cherry picked from commit 43003851129556acea15539a1dc0d4350d54cac8)