s3:smbd/open: try the primary sid (user) as group_sid if the token has just one sid