Port of 7b05ec4 to the release/1.7 call shape, which reads user
databases via path-based user.ParsePasswdFile* / ParseGroupFile*
helpers rather than the fs.FS-based openUserFile wrapper introduced
later on main.

UserFromPath, GIDFromPath, getSupplementalGroupsFromPath, and the
setAdditionalGids closure in WithAppendAdditionalGroups now open
/etc/passwd or /etc/group via openBoundedUserFile, which stats the
resolved path, refuses anything that is not a regular file, and
returns an io.ReadCloser that caps reads at maxUserFileBytes (10
MiB). The reader is consumed by the user.ParsePasswdFilter /
ParseGroupFilter / ParseGroup variants. All four call sites read
either etc/passwd or etc/group; both are regular files on real
systems, well under the cap.

The cap and the regular-file check together bound parser memory use
when reading user-database files of unexpected shape or size.

Adds tests for the cap and for the non-regular file rejection. The
cap test covers three boundary points: a small pad (trailing entry
parsed), a pad placing the entry's last byte exactly on the cap
(still parsed), and a pad past the cap (read returns an "exceeds"
error). The non-regular test verifies a FIFO at etc/group is
rejected before any read is attempted.

Updates TestWithAppendAdditionalGroupsNoEtcGroup to expect "stat
... no such file or directory" instead of "open ...". The
soft-on-missing behavior of WithAppendAdditionalGroups is unchanged.

(cherry picked from commit 7b05ec4)
Signed-off-by: Chris Henzie <[email protected]>
Signed-off-by: Brian Goff <[email protected]>
Signed-off-by: Chris Henzie <[email protected]>

Signed-off-by: Samuel Karp <[email protected]>