mgetgroups: add xgetgroups, and avoid ENOSYS failures