user: fail closed if supplementary groups survive a denied setgroups

[andreeapid]

make test starts a jail from a process that carries an inherited
supplementary group and expects nsjail to refuse:

setpriv --reuid 1000 --regid 1000 --groups 1234 -- ./nsjail -q -Mo \
  --user 65534 --group 65534 --disable_clone_newnet --disable_clone_newcgroup \
  --disable_clone_newns --disable_clone_newpid --disable_clone_newipc \
  --disable_clone_newuts --disable_proc -- /bin/true

On Ubuntu 26.04 (kernel 7.0.0-15-generic) master returns 0 instead of the
expected 255. After the parent writes deny to /proc/pid/setgroups,
setgroups(2) fails with EPERM and that is treated as expected, but entering
a user namespace does not drop supplementary groups, so the jailed process
keeps the ones it inherited.

Check with getgroups(2) and fail if any group remains.

With the patch the test above returns 255 and logs setgroups(0, []) failed and 1 supplementary group(s) remain. The --clear-groups variant still returns 0,
and an ordinary jail still starts.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.