fix: apply the same rules to groups as for user in passwordless sudo