simple-access-provider: make user grp res more robust
    
    Not all user groups need to be resolved if group deny list is empty.
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/2519
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
    (cherry picked from commit 82a958e6592c4a4078e45b7197bbe4751b70f511)