nss-systemd: properly handle empty membership lists
    
    When we are queried for membership lists on a system that has exactly
    zero, then we'll return ESRCH immediately instead of at EOF. Which is
    OK, but we need to handle this in various places, and not get confused
    by it.
    
    (cherry picked from commit a1aa41e4e175c2712b97600d7e10e9d6c58e5543)