We must not return ENOMEM, but rather -1 with 'errno' set to ENOMEM, as
described in the manual page and as other implementations are doing.
A malloc() failure actually already sets ENOMEM for us. Add comments
indicating which function set 'errno' each time we return.

While here, improve style and remove useless headers.

Fixes: 54404cfb13d4 ("In preparation for raising NGROUPS and NGROUPS_MAX, ...")
MFC after: 1 week
Sponsored by: The FreeBSD Foundation