Security hardening (#426)

- Switch gid and supplementary groups to user's when reading user's
  config
- Only show users between UID_MIN and UID_MAX in /etc/login.defs
- Open accountsservice icons with O_NOFOLLOW to explicitly disallow
  symlinks

cosmic-greeter-config/src/user.rs

@@ -7,13 +7,7 @@ use std::num::NonZeroU32;
 /// Per user state for Greeter.
 #[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
 pub struct UserState {
-    #[serde(skip_serializing_if = "invalid_uid")]
     pub uid: NonZeroU32,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub last_session: Option<String>,
 }
-
-// Only serialize users not system accounts
-const fn invalid_uid(uid: &NonZeroU32) -> bool {
-    uid.get() < 1000
-}