userdb: Add userdb.user.* and userdb.group.* credentials

Let's allow providing extra userdb users and groups via credentials.
Similarly to systemd-udev-load-credentials.service, we ship
systemd-userdb-load-credentials.service which transform the JSON
user/group records provided via the corresponding credentials to static
userdb dropins in /etc/userdb.

Replaces #33811

man/systemd.system-credentials.xml

@@ -471,6 +471,40 @@
           <xi:include href="version-info.xml" xpointer="v257"/>
         </listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>userdb.user.*</varname></term>
+        <term><varname>userdb.group.*</varname></term>
+
+        <listitem>
+          <para>Configure JSON user and group records. Read by
+          <filename>systemd-userdb-load-credentials.service</filename>, which invokes
+          <command>userdbctl load-credentials</command>. These credentials directly translate to
+          matching
+          <ulink url="https://systemd.io/USER_RECORD">JSON User</ulink> and
+          <ulink url="https://systemd.io/GROUP_RECORD">JSON Group</ulink> records. Example: the contents of a
+          credential <filename>userdb.user.foobar</filename> will be copied into a file
+          <filename>/etc/userdb/foobar.user</filename>, and
+          <filename>userdb.group.foobar</filename> will be copied into a file
+          <filename>/etc/userdb/foobar.group</filename>. Symlinks for the uid/gid will also be created in
+          <filename>/etc/userdb/</filename>, as well as the corresponding<filename>.membership</filename>
+          files. See
+          <citerefentry><refentrytitle>systemd-userdb</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
+          <citerefentry><refentrytitle>nss-systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>, and
+          <citerefentry><refentrytitle>userdbctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+          for details.</para>
+
+          <para>Any passed user records must contain uid and gid fields. Any passed group records must
+          contain a gid field. For both user and group records, the credential suffix (for
+          <literal>userdb.user.foobar</literal> the suffix is <literal>foobar</literal>) must match the user
+          or group name field from the user or group record.</para>
+
+          <para>Note that the records are created in <filename>/etc/userdb/</filename>
+          (<filename>/etc/passwd</filename> and <filename>/etc/group</filename> are not modified).</para>
+
+          <xi:include href="version-info.xml" xpointer="v258"/>
+        </listitem>
+      </varlistentry>
     </variablelist>
   </refsect1>