NSS: Add the hybrid-MPG mode
    
    Implements the functionality of the hybrid private group mapping.
    Uncharacteristically, all the functionality is implemented in the
    responder only.
    
    This is because this hybrid mode must not shadow real groups with
    autogenerated ones, not even if the real group comes from another
    domain. Therefore, the user or group resolution must really call the full
    cache_req requests.
    
    Related:
    https://pagure.io/SSSD/sssd/issue/3822
    
    Reviewed-by: Michal Židek <mzidek@redhat.com>