nix/daemon: consider supplementary groups during authentication

Two things happens here:

- we consider supplementary groups that are known for authentication,
fixes #968.

- we check supplementary groups if they are our build users group and
throw an error if they are (new behavior).

Nonetheless, we did not remove the ability for `matchUser` to recurse
and check for groups that the user may have but the connection might not
have communicated as part of their groups, i.e. if a process reduces its
list of groups via a call to setgroups, it will still be authorized.
This will come in another commit.

The authorization NixOS test has been extended with a store ping test
running in systemd with DynamicUser=true *AND* a supplementary group in
allowed-users.

Co-authored-by: Tom Hubrecht <github@mail.hubrecht.ovh>
Change-Id: I25b2b8304d66a04651cea523b5585a5d15ceebe8
Signed-off-by: Raito Bezarius <raito@lix.systems>

doc/manual/rl-next/supplementary-groups-support.md

@@ -0,0 +1,11 @@
+---
+synopsis: "Supplementary groups are now supported for daemon authentication"
+cls: [5021]
+issues: [fj#968]
+category: "Improvements"
+credits: [raito, thubrecht, alois31, horrors]
+---
+
+Linux now support receiving supplementary groups during UNIX domain authentication to a Lix daemon.
+
+This change is particularly beneficial for systemd units with `DynamicUser=true` that need to connect to a Lix daemon, using a `SupplementaryGroups=` allocated by systemd in the context of the process. This is desirable if you wish to harden Lix clients.