Set default gracelimit on group password policies to -1
    
    This will retain previous behavior of unlimited LDAP BIND
    post-expiration.
    
    Fixes: https://pagure.io/freeipa/issue/9212
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>