userdb: Reference-count DBusUserInfo, DBusGroupInfo

Previously, the hash table indexed by uid (or gid) took ownership of the
single reference to the heap-allocated struct, and the hash table
indexed by username (or group name) had a borrowed pointer to the same
struct that exists in the other hash table.

However, this can break down if you have two or more distinct usernames
that share a numeric identifier. This is generally a bad idea, because
the user-space model in such situations does not match the kernel-space
reality, and in particular there is no effective kernel-level security
boundary between such users, but it is sometimes done anyway.

In this case, when the second username is looked up in the userdb, it
overwrites (replaces) the entry in the hash table that is indexed by
uid, freeing the DBusUserInfo. This results in both the key and the
value in the hash table that is indexed by username becoming dangling
pointers (use-after-free), leading to undefined behaviour, which is
certainly not what we want to see when doing access control.

An equivalent situation can occur with groups, in the rare case where
a numeric group ID has two names (although I have not heard of this
being done in practice).

Solve this by reference-counting the data structure. There are up to
three references in practice: one held temporarily while the lookup
function is populating and storing it, one held by the hash table that
is indexed by uid, and one held by the hash table that is indexed by
name.

Closes: dbus#305
Signed-off-by: Simon McVittie <smcv@collabora.com>
11 jobs for issue305 in 8 minutes and 26 seconds (queued for 2 seconds)
Status Job ID Name Coverage
  Build
passed #3384529
build:cmake

00:02:32

passed #3384526
build:debug

00:08:26

manual #3384531
allowed to fail manual
build:i686-w64-mingw32-cmake
passed #3384530
build:i686-w64-mingw32-debug

00:04:16

manual #3384528
allowed to fail manual
build:legacy
passed #3384525
build:production

00:03:54

manual #3384527
allowed to fail manual
build:reduced
manual #3384534
allowed to fail manual
build:stretch
passed #3384532
build:x86_64-w64-mingw32

00:03:48

passed #3384533
build:x86_64-w64-mingw32-cmake-debug

00:06:01

manual #3384535
allowed to fail manual
build:xenial