service accounts get 'systemuser' group by default

Current account janitorial logic assumes accounts
will be in a supplementary group that, ideally,
indicates purpose.  This logic adds systemsusers to a
namesake group by default.

Change-Id: I43f77f6533770a57406363c80adbe5350b8362b5