Fix argv injection in _create_user and gpasswd loop

[Softer]

Same class of bug as #4443, two sibling call sites that were missed back then. _create_user and the gpasswd loop interpolate user.username and group into f-strings that reach SysCommand(f'arch-chroot -S {target} {cmd}'), where shlex.split parses the payload as argv. A username like --uid 0 or -G wheel,root is accepted as useradd/gpasswd flags and gives trivial escalation. Vector is the same as #4443: custom install.py, plugins, tampered --config JSON.

Changes

_create_user now builds an argv list and calls run(). Failures are logged via debug(), and the SystemError re-raise is kept so guided install still aborts.

The gpasswd loop gets the same switch. Also wrapped it in try/except with debug() - previously a failing gpasswd was silently ignored.