LDAP: Fix retrieving a group with no members
    
    sysdb_attrs_get_el() cannot return ENOENT. Even if the requested member
    doesn't exist, an empty element is created instead. This patch changes
    the code to use sysdb_attrs_get_el_ext() which returns ENOENT.
    
    The code only ever worked because we forgot to check the return value of
    sdap_nested_group_split_members(). When the empty attribute reached
    sdap_nested_group_split_members(), the function returned ENOMEM and
    count == 0. The caller used to only check the value of count, not the
    retval.
    
    Reviewed-by: Pavel Reichl <preichl@redhat.com>