dsdb: Split out construct_generic_token_groups() so we can reuse it