pam: add option pam_initgroups_scheme
This new option should be used to tell the PAM responder to refresh the
user's group memberships either with every new PAM session or always
rely on cached data or refresh the data only if the user currently has
no active login session.
Resolves: https://pagure.io/SSSD/sssd/issue/4098
Reviewed-by: Pavel Březina <pbrezina@redhat.com>