check-passwd/groups options

This relies on the rpm-ostree compose check passwd/groups options.