Describe entry-invariant fields separately

Makes it easier to change (well, add to) the invariants.

Change-Id: I1e578a470a418ad12aae864ac83608120fe74044
Wordsmith the 'id' field a bit

It is useful even if this is not the principal entry for the
user/group.

Change-Id: Icd6af23fc83c4d030dd0c203b1c5ee78bf398f24