PAM: make initgroups timeout work across multiple clients
    
    Instead of timing out the initgroups lookup on a per-cctx basis,
    we will maintain a hash table of recently-seen users and use this
    instead. This will allow SSSD to handle user's logging into
    multiple services simultaneously more graciously, as well as
    playing nicer with SSH (which makes calls to PAM both before and
    after a fork).
    
    https://fedorahosted.org/sssd/ticket/1063