Phase 1 of 'Opt-in per-snap users/groups' (aka, the 'daemon' user)

[galgalesh]

Note: The currently implemented parts of this seem to be documented here: System usernames