Add sartoris user with optional secondary groups

For the frontend, we want to be able to specify the deployment
repos via puppet git::clone. The repos should be owned by a common
non-root user, though.

Change-Id: I09a87dbfae8f70c7c823bfb553db55146ad6584c
Merge "Add sartoris user with optional secondary groups" into production