direct: restrict Smack checks in remove_group to user layers

Buxton currently assumes that root clients have CAP_MAC_* and non-root
clients lack these capabilities, so we should not require a remove_group
Smack check for system layers. Under the current model, the Smack
enforcement only makes sense for user layers.

I am not considering the case where root clients may write to their user
layer, since I don't think we have use cases for this scenario.