fix(security): remove container daemon group access

modules/nixos/base/user-group.nix

@@ -34,8 +34,6 @@
       "users"
       "wheel"
       "networkmanager" # for nmtui / nm-connection-editor
-      "podman"
-      "docker"
       "wireshark"
       "adbusers" # android debugging
       "libvirtd" # virt-viewer / qemu

outputs/x86_64-linux/tests/security-container-groups/expected.nix

@@ -0,0 +1,4 @@
+{
+  userHasDockerAccess = false;
+  userHasPodmanAccess = false;
+}

outputs/x86_64-linux/tests/security-container-groups/expr.nix

@@ -0,0 +1,8 @@
+{ outputs, ... }:
+let
+  userGroups = outputs.nixosConfigurations.ai-niri.config.users.users.ryan.extraGroups;
+in
+{
+  userHasDockerAccess = builtins.elem "docker" userGroups;
+  userHasPodmanAccess = builtins.elem "podman" userGroups;
+}