[nemo] Implement checking of effective GID of caller

This allows us to do fine-grained permission checking without
the limitations of the D-Bus busconfig XML configuration files.

Caveats right now:

  - Malicious apps can listen to the passwordChanged signal
    for generated passwords, and get the generated password
  - Malicious apps can listen to calls and capture a manually-
    set password by monitoring the setPassword call