userdb: apply UUID filters to group records

group_record_match() handled the other filters, but ignored match->uuid,
so userdbctl group --uuid=... could still return non-matching groups.

Add the same UUID check used by user_record_match().

Reproduced locally:
build/userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa \
  --output=json group root

Before result:
The command succeeded and printed the root group record.

Follow-up for: 466562c69b

src/shared/group-record.c

@@ -372,6 +372,9 @@ bool group_record_match(GroupRecord *h, const UserDBMatch *match) {
         if (!BIT_SET(match->disposition_mask, group_record_disposition(h)))
                 return false;
 
+        if (!sd_id128_is_null(match->uuid) && !sd_id128_equal(match->uuid, h->uuid))
+                return false;
+
         if (!strv_isempty(match->fuzzy_names)) {
                 const char* names[] = {
                         h->group_name,

src/shared/userdb.c

@@ -203,6 +203,7 @@ static int userdb_maybe_restart_query(
         static const char *const fields[] = {
                 "fuzzyNames",
                 "dispositionMask",
+                "uuid",
                 "uidMin",
                 "uidMax",
                 "gidMin",

src/shared/varlink-io.systemd.UserDatabase.c

@@ -18,6 +18,8 @@ static SD_VARLINK_DEFINE_METHOD_FULL(
                 SD_VARLINK_DEFINE_INPUT(uidMin, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("Maximum UID to restrict search too."),
                 SD_VARLINK_DEFINE_INPUT(uidMax, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The UUID to restrict search to."),
+                SD_VARLINK_DEFINE_INPUT(uuid, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("The userdb provider to search on. Must be set to the name of the userdb entrypoint socket. This is necessary in order to support services that implement multiple userdb services on the same socket."),
                 SD_VARLINK_DEFINE_INPUT(service, SD_VARLINK_STRING, 0),
                 SD_VARLINK_FIELD_COMMENT("The retrieved user record."),
@@ -41,6 +43,8 @@ static SD_VARLINK_DEFINE_METHOD_FULL(
                 SD_VARLINK_DEFINE_INPUT(gidMin, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("Maximum GID to restrict search too."),
                 SD_VARLINK_DEFINE_INPUT(gidMax, SD_VARLINK_INT, SD_VARLINK_NULLABLE),
+                SD_VARLINK_FIELD_COMMENT("The UUID to restrict search to."),
+                SD_VARLINK_DEFINE_INPUT(uuid, SD_VARLINK_STRING, SD_VARLINK_NULLABLE),
                 SD_VARLINK_FIELD_COMMENT("The userdb provider to search on. Must be set to the name of the userdb entrypoint socket. This is necessary in order to support services that implement multiple userdb services on the same socket."),
                 SD_VARLINK_DEFINE_INPUT(service, SD_VARLINK_STRING, 0),
                 SD_VARLINK_FIELD_COMMENT("The retrieved group record."),

test/units/TEST-74-AUX-UTILS.userdbctl.sh

@@ -55,6 +55,9 @@ assert_eq "$(userdbctl user 2147352576 -j | jq -r .userName)" foreign-0
 assert_eq "$(userdbctl user 2147352577 -j | jq -r .userName)" foreign-1
 assert_eq "$(userdbctl user 2147418110 -j | jq -r .userName)" foreign-65534
 
+(! userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa user root)
+(! userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa group root)
+
 # Make sure that -F shows same data as if we'd ask directly
 userdbctl user root -j | userdbctl -F- user | cmp - <(userdbctl user root)
 userdbctl user test-74-userdbctl -j | userdbctl -F- user | cmp - <(userdbctl user test-74-userdbctl)