internal/as_user: drop supplementary groups - #2301

Summary

set_eids() in internal/as_user/as_user.c switches the effective gid and uid
to the target user, but never touches the supplementary group list. The
privilege-dropped thread therefore keeps the caller's group memberships — in
practice root's — while acting as that user.

This drops the list with setgroups(0, NULL) before the gid and uid are
relinquished, while the thread still holds the privilege required to make that
call, following the revocation order described in
CERT POS36-C.

Reproducer

I built a probe against as_user.c before and after the change. It makes the
caller (root) a member of gid 4242, creates a directory owned root:4242 with
mode 0770 — so "other" has no access — and then asks au_open() to create a
file inside it as uid=65534 gid=65534, which is not a member of 4242:

So the retained groups do grant real access during the switch, not just a
theoretical capability.

Impact

Low, and I don't want to oversell it. As #2242 notes, Ignition already runs as
root and as_user is defense-in-depth rather than a security boundary; the only
caller is writeAuthKeysFile() in internal/exec/util/passwd.go, writing SSH
authorized keys during first boot, where root's supplementary groups are
typically just {0}. This is a correctness fix that brings the privilege drop
in line with POSIX practice, and matters more for any future reuse of this code.

Notes

• <grp.h> is added for the setgroups() declaration; the cgo build uses
  -Werror=implicit-function-declaration, so a missing declaration would be
  fatal rather than silent.
• The call fails closed: if setgroups() fails, set_eids() returns an error
  rather than continuing with a partial privilege drop.
• setgroups(0, NULL) clears the list rather than installing the target user's
  own groups. Installing the real list would mean either an NSS lookup inside
  the cloned thread or widening au_ids_t to carry the group list from Go.
  Happy to do the latter if you'd prefer it — clearing seemed like the right
  minimal fix for the reported issue.

Testing

• ./test — Success, exit 0 (Fedora 44, Go 1.24, cgo, run as a non-root
  user)
• ./build ignition — exit 0
• git diff --check — clean
• The probe above, compiled against the original and patched as_user.c

Running ./test as root instead fails TestTranslateTree/translate_7 in the
seven butane/base/* packages, because that test asserts a permission-denied
error which root bypasses. That failure reproduces identically on an unmodified
origin/main, so it is unrelated to this change.

No new in-tree test: internal/as_user is Linux-, cgo- and root-only, has no
existing unit tests, and a regression test for this would have to manipulate the
test process's own credentials. I'm glad to add a root-gated one if you want it.

Fixes #2242.