OPENAFS-SA-2016-001 group creation by foreign users

OPENAFS-SA-2016-001 group creation by foreign users

CVE-2016-2860:

The ptserver permits foreign-cell users to create groups as if they were
system:administrators.  In particular, groups in the user namespace
(with no colon) and the system: namespace can be created.  No group
quota is enforced for the creation of these groups, but they will be
owned by system:administrators and cannot be changed by the user that
created them.  When processing requests from foreign users, the
creator ID is overwritten with the ID of system:administrators, and
that field is later used for access control checks in
CorrectGroupName(), called from CreateEntry().

The access-control bypass is not possible for creating user entries,
since there is an early check in CreateOK() that only permits
administrators to create users, using a correct test for whether
the call is being made by an administrator.

FIXES 132822

[Based on a patch by Jeffrey Altman.]

Change-Id: I77dcf4a2f7d9c770c805a649f2ddc6bee5f83389