remove user certificate if not found on the server
    
    If the user is not found by cert lookup when the user is already
    cached, two things may happen:
    1) cert was removed from the user object
    2) user was removed
    
    Instead of issuing another cert lookup we will just remove cert
    attribute from the cache not touching the expiration timestamp so
    the user may be updated later when needed.
    
    Resolves:
    https://fedorahosted.org/sssd/ticket/2934
    
    Reviewed-by: Sumit Bose <sbose@redhat.com>
    (cherry picked from commit 659232f194f83ec7c450ce89c3fd41e4e74409f2)