nss: warm the group mmap cache during initgroups

[karlg100]

Problem

With ignore_group_members enabled, an initgroups response already contains
the name and GID needed for a memberless group memory-cache entry.

However, the NSS responder currently caches only the initgroups result. It
does not populate the group mmap cache for the groups returned by that
request. Callers may therefore resolve each returned GID separately,
repeating responder and cache work during login and VPN-sensitive
authentication paths.

Solution

While constructing an initgroups response:

• store each returned group in the group mmap cache;
• use an empty member list, consistent with ignore_group_members;
• skip warming when group members are not ignored;
• skip warming when cache invalidation was explicitly requested;
• reuse one temporary talloc context across the result loop.

Failure to warm an individual group remains non-fatal and does not change the
initgroups response.

Tests

Wrap sss_mmap_cache_gr_store() in the NSS responder unit test and verify
that:

• both initgroups groups are written to the mmap cache;
• the expected names and GIDs are stored;
• no synthetic group members are added.

Scope

This is an independent NSS responder optimization. It does not depend on the
verified-group rename or transactional memberOf changes in #9050 and #9051,
and it is not required for the #9049 watchdog fix.

Validation

• The equivalent change is present in the tested RHEL 9 and RHEL 10
  investigation branches.
• NSS responder tests passed on those branches.
• The exact master-based branch will be built and its focused NSS tests run
  before marking this PR ready for review.

Related: #9049