handle user/group existence gracefully

Comment from pn, in June:

My usual style is to do this:

group "foo" do
 blah blah blah
 not_if "getent group | grep -q foo"
end

This lets us create the user if installed on a system that's not part of our
LDAP infrastructure (e.g. vagrant, or if we publish it). In theory the
user/group resource should do this anyway, but in practice there have been bugs
where it'll try to do stuff on the filesystem that'll mislead it into thinking
it needs to add the user, etc.
bringing inline with kcb_skel
adding tests for the mirror recipe