nss-systemd: copy PASSWORD_SEE_SHADOW into the group record buffer

nss_pack_group_record() left gr_passwd pointing at PASSWORD_SEE_SHADOW,
which is part of the module's read-only .rodata. That breaks callers that
modify the returned group before freeing it, in particular
pam_modutil_cleanup_group(), which zeroes gr_passwd when the PAM handle
is torn down and then segfaults on read-only memory.

Copy the placeholder into the caller-provided buffer, as
nss_pack_user_record() already does.

(cherry picked from commit c7a8e871de3427cf654d9a608dc58663874197bb)

src/nss-systemd/userdb-glue.c

@@ -229,6 +229,8 @@ int nss_pack_group_record(
         assert(g->group_name);
         required = strlen(g->group_name) + 1;
 
+        required += strlen(PASSWORD_SEE_SHADOW) + 1;
+
         STRV_FOREACH(m, g->members) {
                 required += sizeof(char*);  /* space for ptr array entry */
                 required += strlen(*m) + 1;
@@ -267,12 +269,14 @@ int nss_pack_group_record(
         array[n] = NULL;
 
         *gr = (struct group) {
-                .gr_name = strcpy(p, g->group_name),
+                .gr_name = p,
                 .gr_gid = g->gid,
-                .gr_passwd = (char*) PASSWORD_SEE_SHADOW,
                 .gr_mem = array,
         };
 
+        gr->gr_passwd = stpcpy(gr->gr_name, g->group_name) + 1;
+        strcpy(gr->gr_passwd, PASSWORD_SEE_SHADOW);
+
         return 0;
 }