userspec: disallow an ID that maps to (uid_t)-1 or (gid_t)-1