nix/daemon: consider supplementary groups during authentication

Two things happens here:

- we consider supplementary groups that are known for authentication,
fixes #968.

- we check supplementary groups if they are our build users group and
throw an error if they are (new behavior).

Nonetheless, we did not remove the ability for `matchUser` to recurse
and check for groups that the user may have but the connection might not
have communicated as part of their groups, i.e. if a process reduces its
list of groups via a call to setgroups, it will still be authorized.
This will come in another commit.

The authorization NixOS test has been extended with a store ping test
running in systemd with DynamicUser=true *AND* a supplementary group in
allowed-users.

Co-authored-by: Tom Hubrecht <github@mail.hubrecht.ovh>
Change-Id: I25b2b8304d66a04651cea523b5585a5d15ceebe8
Signed-off-by: Raito Bezarius <raito@lix.systems>

tests/nixos/authorization.nix

@@ -1,15 +1,28 @@
 {
   name = "authorization";
 
-  nodes.machine = {
+  nodes.machine = { config, ... }: {
     virtualisation.writableStore = true;
     # TODO add a test without allowed-users setting. allowed-users is uncommon among NixOS users.
-    nix.settings.allowed-users = ["alice" "bob"];
+    nix.settings.allowed-users = ["alice" "bob" "@special-group"];
     nix.settings.trusted-users = ["alice"];
 
     users.users.alice.isNormalUser = true;
     users.users.bob.isNormalUser = true;
     users.users.mallory.isNormalUser = true;
+    users.groups.special-group = {};
+
+    systemd.services.nix-connect-test = {
+      description = "Test Nix daemon connection as a DynamicUser with allowed suppgp";
+      serviceConfig = {
+        DynamicUser = true;
+        SupplementaryGroups = "special-group";
+        ExecStart = "${config.nix.package}/bin/nix store ping";
+        Restart = "on-failure";
+        RemainAfterExit = true;
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
 
     nix.settings.experimental-features = "nix-command";
   };
@@ -20,6 +33,7 @@
   in
   ''
     machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("nix-connect-test.service")
     machine.succeed("""
       exec 1>&2
       echo kSELDhobKaF8/VdxIxdP7EQe+Q > one