simple-access-provider: make user grp res more robust
    
    Not all user groups need to be resolved if group deny list is empty.
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/2519
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>