nss: skip incomplete groups instead of bailing out
    
    Suppose the user U is a member of (AD) groups D1\A, D1\B, D2\X, and no
    domain controllers in the domain D2 can be reached at the moment (and
    there are no cached info). As of now initgroups won't assign any groups
    at all. To improve the behavior skip the incomplete groups so initgroup
    assigns at least some groups (D1\A, D1\B in the above example).
    
    Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>