Split OciImageConfig's user into separate user/group fields

--user/--group are now handled as separate strings (ResolvedUser), so
parse config.User's "<user>[:<group>]" the same way instead of leaving
callers to split the combined spec themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

src/oci_image.h

@@ -66,7 +66,8 @@ struct OciExposedPort {
 };
 
 struct OciImageConfig {
-    std::string user;                          // config.User, e.g. "git:git"; empty if unset
+    std::string user;                          // config.User's "<user>" part; empty if unset
+    std::string group;                         // config.User's optional ":<group>" part; empty if unset
     std::vector<OciExposedPort> exposed_ports;  // config.ExposedPorts keys, parsed "<port>/<proto>"
     std::vector<std::string> env;               // config.Env, e.g. "PATH=..."
     std::vector<std::string> volumes;           // config.Volumes keys, e.g. "/var/lib/mysql"