s3-passdb: move group mapping headers into passdb.h