CRED: Separate per-task-group keyrings from signal_struct