Eauth group support

This provides initial support for eauth groups for the PAM provider *only*.

There is no support for LDAP, etc. Providers other than PAM should simply no-op if a ```groups``` function is not found. 

The syntax for adding a group in a master configuration files is as follows:

```
my_group%:
  - '*':
    - test.echo
```
(Note the trailing '%', which indicates a group definition.)

The above block indicates that any user returned by PAM which is a member of the ```my_group``` group on the system should be authorized for the ```test.echo``` function on all minions in *addition* to all functions granted to her by explicit user permission in the master configuration file for the given provider.