Expand unresolved addresses to matching groups for approval dialog

The approval dialog doesn't know groups. To allow the users to see why a
group wasn't resolved, we expand unresolved addresses that match a group
but not a certificate to the matching group's certificates before
showing the approval dialog.

• GnuPG-bug-id: T6401