ad: store group in correct tree on initgroups via tokenGroups
    
    If tokenGroups contains group from different domain than user's,
    we stored it under the user's domain tree in sysdb. This patch
    changes it so we store it under group's domain tree.
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/2066