Remove the fixed, built-in password of user vpgadmin and reduce the blast radius of the vpgadmin user

The VIOS vpgadmin user has a known pre-defined password(1), that can't be changed(2).

Although the user has login=false, and rlogin=false (3), it's a user that is part of the bin and system groups (4).

One common request of many security policies is that before a machine is put into production, all pre-defined passwords must be changed (5). Failure to do so involves risk letters and a protracted back-and-forth with the security people, to which is particularly hard to explain how 34 years after the Morris Worm, IBM thinks it's OK to ship a default password that can't be changed.

A possible solution:
- On install create a random 8-char password and stash it into a file.
- Said file should be owned by root, mode 640, and belong to a group (say group G).
- Binaries that have a need to know, belong to group G with a set-groupid flag. Password can then be read from the file without being exposed.
- One script to re-randomize the password (on every boot, or when the root user so decides)


1 - I know the password, I'm not putting it here. If I could find it, others can also.
2 - It's compiled in to at least one binary (see TS009575790), and IBM doesn't support changing it (see https://www.ibm.com/support/pages/purpose-user-id-vpgadmin-virtual-io-server)
3 - Having the ability to do defense in depth is a must-have for any operating systems.
4 - Being a part of the bin group allows it to replace any file in /usr/ucb, and being part of system allows it to run multiple commands with the same authority as root. A postgres instance owner should have ONE group: postgres.
5 - This is a best practice common across the industry, and was a part of IBM's own security rules until November 4, 2021.