_usergroup now has a -u option, and there are new _allowed_users and
_allowed_groups helpers. These can be used to limit returned users
and/or groups to ones that the user has access to (or should be
assumed to have access to if running a "root command").
I had to remove a couple of "funky user" chown test cases because for
some reason they were broken by this change, I didn't immediately find
out why, and I couldn't come up with a valid use case that should be
supported for them that would be more beneficial than the relevance
improvements in this patch.
