The policy work changed the groups special attribute from "groups" -> "_groups", apply appropriate renaming in SP so that the leading _ is dropped (if there are no conflicting attributes) when sending to SPs.

Also filter out any attribute with a leading _, as those are meant to be private to Ipsilon unless explicitly mapped.

This issue ticket was originally removed from the tracker as it clashed with the pull request.
See upstream ticket for migration details.