Add separate app-manager group

Although there are probably not any issues in practice with having
app-manager part of nogroup, it's cleaner to have the app-manager user
totally isolated so that the files it creates in /var/endless don't
somehow become writable by unintended users.

[endlessm/eos-shell#2915]