[security] ensure gid != 0 if server.username set (fixes #2725)