PrincipalPrivilegeTree doesn't handle empty string and wildcards correctly

Two bugs slipped through the tests in IMPALA-9242:
1. It assumes that unfilled elements in a privilege (e.g. table in a database privilege) are null, which is true in FE tests, but it is an empty string when the privilege comes from SentryPrivilege.
2. wildcards (e.g. * in server=server1->db=tpcds->table=*) are not handled well in the tree - it will be added as a table level privilege, while it should be added as a database-wide privilege