Fix supplementary groups for machine users

[rupinajay]

Summary

Fixes #2108.

container machine run was constructing the default machine user as a numeric .id(uid:gid:), which prevented the guest containerization runtime from resolving supplementary groups from /etc/group.

Updating UserSetup.user to return .raw(userString: username) when a username is available allows the existing guest credential-resolution mechanism in the containerization runtime to look up /etc/passwd and /etc/group inside the guest VM. Consequently, supplementary groups added to the machine user (e.g. via usermod -aG <group> <user> or addgroup) are dynamically inherited on subsequent container machine run invocations.

This fix uses the existing ProcessConfiguration.User.raw abstraction designed for username lookup and avoids running /sbin.machine/init as root or introducing su -l.

Testing

• Tested locally
• Added/updated tests
• Added/updated docs

Production build:
swift build --target ContainerBuild completed successfully.

Formatting & linting:
make fmt and git diff --check completed cleanly with no warnings or errors. Pre-commit hooks installed.

Unit test suite:
make test executed locally and passed all 757 unit tests (0 failures).

Machine integration test:
Added testMachineUsermodSupplementaryGroups in Tests/IntegrationTests/Machine/TestCLIMachineRuntimeSerial.swift. Verified end-to-end inside an actual VM that supplementary groups created with addgroup and assigned to the user are dynamically reflected in subsequent container machine run commands.