enhance rkhunter checks to report changed users and groups