idmap: centrally check that unix IDs returned by the idmap backends are in range