nspawn: set ping group range for userns containers

A newly created network namespace may disallow ICMP echo sockets for
unprivileged users even when their GIDs are mapped into the container.

When creating both user and network namespaces, initialize
net.ipv4.ping_group_range using the mapped GID range capped at INT32_MAX.
This follows the system-wide default from sysctl.d/50-default.conf while
respecting the user namespace mapping and the kernel's accepted limit.
Leave externally supplied network namespaces untouched and treat write
failures as non-fatal warnings.

Add regression coverage for the default 64K mapped range using the tools
already available in the minimal container image.

Fixes #41603

test/units/TEST-13-NSPAWN.nspawn.sh

@@ -1211,6 +1211,26 @@ matrix_run_one() {
     return 0
 }
 
+testcase_ping_group_range() {
+    local range root
+
+    if [[ "$IS_USERNS_SUPPORTED" == "no" ]]; then
+        echo "Skipping user namespace test..."
+        return 0
+    fi
+
+    root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.ping-group-range.XXX)"
+    create_dummy_container "$root"
+    trap 'rm -fr "$root"' RETURN ERR
+
+    range="$(systemd-nspawn --pipe --register=no \
+                            --directory="$root" \
+                            --private-network \
+                            --private-users=pick \
+                            cat /proc/sys/net/ipv4/ping_group_range)"
+    assert_eq "${range//[[:space:]]/ }" "0 65535"
+}
+
 testcase_api_vfs() {
     local api_vfs_writable