Don't clean up groups for which a user has it as primary GID
    
    We were cleaning up all groups that were expired and for which
    there existed no user with memberOf: <thegroup> as an attribute.
    
    This patch modifies the search to also check for cached users with
    this group's GID as their primary GID.
    
    Fixes https://fedorahosted.org/sssd/ticket/624