Add API for create_group

Until now, set_label was serving three purposes:

- add/modify a label for a group
- add/modify a label for a key (currently, support is incomplete)
- create a group

To simplify the libbuxton API and the required access checking logic,
we've decided to extend the API with create_group, which will replace
the last action item in the above list.

The logic for set_label is updated in the following commit.
direct: change semantics of set_label

Setting labels will no longer implicitly create groups, so create_group
is required before setting the label on that group.

Additionally, disallow set_label for groups and keys within user layers,
since clients writing to user layers will generally be unprivileged.

To make the direct set_label function more in line with create_group,
use the gcc cleanup attributes where appropriate.
test: fix existing tests for latest group changes

The latest changes for group handling require some changes for existing
tests to satisfy the following conditions:

- groups cannot be implicitly created with set_label and instead must
  use the new create_group API
- set_label will fail if the group/key does not exist
- set_label is disallowed for groups/keys in user layers

Specific tests for create_group will be added in a future commit.