ipa-kdb: fix delegation acl check
    
    We need to check for a matching acl only if one match hasn't already been
    found, otherwise results are unpredictable and order dependent.