userns: Don't allow setgroups until a gid mapping has been setablished