Fix sudo chown rule for service groups

The present rule was unapplicable as sudo requires fully qualified
command file names, i. e. "/bin/true" instead of "true".  Also, sudo
requires colons to be escaped with backslashes.

This change does not update the already created, wrong sudo rules for
existing service groups.  It might make sense to clean this up as part
of transitioning service groups to new globally unique names and UIDs
(bug 58997).

Bug: 48105
Change-Id: I834de96fe93452f22ee6e4eec283cf2e958917d0