chroot: make --groups= work without --userspec=; be more robust

chroot: make --groups= work without --userspec=;  be more robust

* src/chroot.c (set_additional_groups): Add comments.
Given an empty or all-comma group list, diagnose it and return nonzero.
When more than one group is invalid, diagnose all of them,
not just the first.
(main): Honor --groups= also when --userspec= is not specified.
Now that set_additional_groups consistently diagnoses its failures,
don't diagnose it separately here.
* tests/chroot/credentials: Do not invoke with an empty group list.