NSS: Add the hybrid-MPG mode
    
    Implements the functionality of the hybrid private group mapping.
    Uncharacteristically, all the functionality is implemented in the
    responder only.
    
    This is because this hybrid mode must not shadow real groups with
    autogenerated ones, not even if the real group comes from another
    domain. Therefore, the user or group resolution must really call the full
    cache_req requests.
    
    Related:
    https://pagure.io/SSSD/sssd/issue/3822
    
    Reviewed-by: Michal Židek <mzidek@redhat.com>
    (cherry picked from commit 2ea38097dc62963403f77c96946a93f8aae11a44)