userns: Don't allow unprivileged creation of gid mappings