useraccount: Handle "-*" in groups parameter.

Allow specifying "-*" as an element in the groups parameter of the
usermgmt::useraccount definition, to remove the user from all groups
listed in $usermgmt::config::default_groups.