Package: put the guard user in adm and systemd-journal

Only the unit's SupplementaryGroups gave them, so 'sudo -u guard guard
test' and 'guard check' could read neither /var/log's files nor the
journal. systemd-sysusers (run on every install and upgrade) adds them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -28,3 +28,11 @@ All notable changes to Guard are documented here. The format follows
   the `adm` and `systemd-journal` groups, published with each release to
   the Gitea Debian registry (`stable`, or `testing` for a release
   candidate) along with tarballs for Linux amd64 and arm64.
+
+### Fixed
+
+- The package's `guard` user is now in the `adm` and `systemd-journal`
+  groups itself, as the documentation said, not only through its unit's
+  `SupplementaryGroups`. `sudo -u guard guard test` and `guard check`
+  could read neither `/var/log`'s files (`permission denied`) nor the
+  journal. Upgrading adds the groups.