add a groups_mode switch between require/exempt

Updated pam_duo to make it easy to specify groups as exempt. While this is already possible, it needs to be done by

    groups = *,!exempt_group

which is rather obtuse. This patch allows you to instead specify

    groups = exempt_group
    groups_mode = exempt

which is more clear. The man page has been updated as well as the module itself.