feat(subp): Support subprocess user and group credentials

[cgroschupp]

Proposed Commit Message

fix(opennebula): avoid sudo when parsing context.sh

OpenNebula parses context.sh as the configured parse user. Previously
this was done by spawning sudo -u, which can block during early boot and
cause cloud-init-local.service to wait for the sudo timeout.

Resolve the parse user with pwd.getpwnam and pass the target uid, gid,
and empty supplemental groups directly through subp.subp to
subprocess.Popen. This preserves the existing sh-based parser while
avoiding sudo during datasource detection.

Add unit coverage for the new subp uid/gid passthrough and for the
OpenNebula parser invocation.

Fixes GH-4078
LP: #2007149

## Additional Context

This change does not alter OpenNebula context.sh semantics. The parser
still runs through `sh -e`; only the user switching mechanism changes
from `sudo -u <user>` to subprocess uid/gid handling.

Documentation update skipped: this is an internal implementation change
and does not change user-facing datasource configuration.

## Test Steps

Static validation performed locally:

- `python3 -m py_compile cloudinit/subp.py cloudinit/sources/DataSourceOpenNebula.py tests/unittests/sources/test_opennebula.py tests/unittests/test_subp.py`
- `git diff --check`

Focused unit test command attempted:

- `pytest -q tests/unittests/sources/test_opennebula.py tests/unittests/test_subp.py`

The pytest run did not start in this local environment because PyYAML is
not installed:

`ModuleNotFoundError: No module named 'yaml'`

A direct local check verified that `subp.subp(..., user=..., group=...,
extra_groups=...)` passes those values through to `subprocess.Popen`.

Checkboxes you can mark based on your state:

• I have signed the CLA: https://ubuntu.com/legal/contributors
• I have included a comprehensive commit message using the guide below
• I have added unit tests to cover the new behavior under tests/unittests/
• I have kept the change small, avoiding unnecessary whitespace or non-functional changes.
• I have added a reference to issues that this PR relates to in the PR message
• I have updated the documentation with the changed behavior.