Fix incorrect routing to GPFS4 side on group lookup failures by ssh proxy

Problem

Matt's XIAS account, which is in gpfs5 group was randomly misrouted to GPFS4 when it should have gone to GPFS5 side. Slack discussion: https://uab-rc.slack.com/archives/C3NUY04QH/p1757630022182989

We suspect it is due to a lookup failure that defaulted to GPFS4 routing.

The current routing system can only distinguish between GPFS5 and "everything else" (GPFS4 + lookup failures)

• SSH Router is more vulnerable to this kind of lookup failures because it relies on the system account database, it also involves application-level caching.

Proposed solution:

Implement a three-state system that can distinguish between:

1. GPFS4 users
2. GPFS5 users
3. Lookup failures (which should deny login rather than default to GPFS4)

This would require updating all users on GPFS4 filesystem to be explicitly marked as GPFS4 group members, and updating the logic in SSH routers to handle lookup failures more deterministically.