Get rid of server_group validator

The server_group validator matches a very specific naming scheme used on original deployment hosts. Now that multiple RAs are possible to configure, it doesn't make sense to keep it anymore.

A more generic glob validator can provide the same functionality now that different authentication results can be bound to different validator chains. This may be the same as the rewrite of common_name/alternative_names validators.