Arvados

The simplest way I've found to do this is:

• all our packages ensure an arvados group exists. (Maybe there's also a way to hook this into systemd?)
• All our service units say:

  [Service]
  DynamicUser=on
  SupplementaryGroups=arvados

  Along with whatever other security options we want. source:services/api/arvados-railsapi.service is already doing a lot of this, but doing it with the www-data/nginx group instead (this gets added by the postinst since it's distro-specific). It would be easier to share across services if we created a dedicated group for Arvados services.