Create escape hatch for supplementary group sandboxing woes

[Ericson2314]

Motivation

There is no obvious good solution for this that has occurred to anyone.

Provide a way to hack around trying to drop supplementary groups when root.

Context

Currently,

unshare --map-root-user nix-build ...

will fail when the outside user is not root, because one doesn't actually have the permission to call setgroups. This provides a work-around to skip that step.

Checklist for maintainers

Maintainers: tick if completed or explain if not relevant

• agreed on idea
• agreed on implementation strategy
• tests, as appropriate
  • functional tests - tests/**.sh
  • unit tests - src/*/tests
  • integration tests - tests/nixos/*
• documentation in the manual
• documentation in the internal API docs
• code and comments are self-explanatory
• commit message explains why the change was made
• new feature or incompatible change: updated release notes

Priorities

Add 👍 to pull requests you find important.

[symphorien]

Alternatively, it's possible to detect that the call will fail by reading /proc/pid/setgroups: it contains deny inside unshare -r

[Ericson2314]

Reopened as #8342 so @benradf can also push.