AD: Handle cases where no GPOs apply
    
    It is possible to have a machine where none of the GPOs associated with
    it include access-control rules. Currently, this results in a
    denial-by-system-error.
    
    We need to treat this case as allowing the user (see the test cases in
    https://fedorahosted.org/sssd/wiki/DesignDocs/ActiveDirectoryGPOIntegration
    
    We also need to delete the result object from the cache to ensure that
    offline operation will also grant access.
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/2713
    
    Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>