Implement getsockopt(SO_PEERGROUPS)

### Description

`getsockopt(SOL_SOCKET, SO_PEERGROUPS)` is not
implemented for AF_UNIX sockets. Linux returns the peer's supplementary group
list as captured at connect()/socketpair() time.

dbus-broker (the system bus on RHEL 9/10, Fedora, Arch) uses this to evaluate
bus policy race-free. Under gVisor the getsockopt fails, so it degrades to
looking up the peer's groups via NSS and logs on every boot:

dbus-broker[38]: Falling back to racy auxiliary groups resolution using nss.

Functionally everything keeps working (the fallback succeeds), so this is a
congruence/robustness gap rather than a breakage: group changes after connect,
or groups not present in /etc/group, resolve differently than on Linux.

## Steps to reproduce

docker run -d --name ubi --runtime=runsc --privileged redhat/ubi10-init
docker exec ubi hostnamectl # any bus client, activates dbus-broker
docker exec ubi journalctl -u dbus-broker.service --no-pager

Observed: the "Falling back to racy auxiliary groups resolution" line.
Expected (runc): no such line; SO_PEERGROUPS returns the peer's groups.

### Is this feature related to a specific bug?

_No response_

### Do you have a specific solution in mind?

_No response_

Start at the getsockopt handling for AF_UNIX sockets and compare its behavior with Linux's SO_PEERGROUPS semantics. Reproduce with the provided runsc/docker commands and verify that getsockopt returns the peer's supplementary groups captured at connect()/socketpair() time, without the dbus-broker fallback.

Written by the indexing model from the issue text.