Thread-safety

[solardiz]

Make -DENABLE_SETFSUGID the default and only implementation, and use the setgroups() direct syscall, so that we don't affect other threads' effective credentials.

As discussed in #14 (comment) @ldv-alt sees "no potential benefits in keeping the non-ENABLE_SETFSUGID variant, and it definitely makes sense to use the setgroups() syscall instead of the glibc function."

[ldv-alt]

There is a complication associated with using syscall() instead of setgroups():
As long as fakeroot doesn't wrap syscall(), libnss_tcb wouldn't work under fakeroot.
I'll have a look what could be done on the fakeroot side.