### Summary

I was surprised to after using Ansible to add some users to a group, that they had been removed from all other groups (crucially, including one used to grant them `sudo` rights!).



### Issue Type

Documentation Report

### Component Name

user_module

### Ansible Version

```console
nsible [core 2.11.5]
  config file = /redacted/git/devops-ansible/ansible.cfg
  configured module search path = ['/home/mark/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.9/site-packages/ansible
  ansible collection location = /home/mark/.ansible/collections:/usr/share/ansible/collections
  executable location = /sbin/ansible
  python version = 3.9.7 (default, Aug 31 2021, 13:28:12) [GCC 11.1.0]
  jinja version = 3.0.1
  libyaml = True
```


### Configuration

```console
N/A
```


### OS / Environment

Arch Linux

### Additional Information

I re-read the docs for the `user` built-in and it only mentions that the user will be *added* to groups mentioned in the groups list. The docs currently fail to mention that they will be removed from all groups *not* in the groups array.

I presume this behavior is as intended, but the docs should clarify that the user's non-primary groups will be set to exactly those in the list, any other pre-existing group memberships will be removed.

Here's a sample playbook that illustrated the behavior:

```yaml
---
- hosts: fave-server
  become: true
  become_user: root
  tasks:
    - name: "add users to some group"
      loop:
        - sue
        - john
      user:
        name: "{{ item }}"
        state: present
        groups:
          - some
```

Try having the users already exist with other group memberships and they will be removed and replace with only a `some` group membership. (I tested with Ansible 2.11.5). 

### Code of Conduct

- [X] I agree to follow the Ansible Code of Conduct
self.home = module.params['home']
        self.expires = None
        self.password_lock = module.params['password_lock']
        self.groups = None
        self.local = module.params['local']
        self.profile = module.params['profile']
        self.authorization = module.params['authorization']
        self.role = module.params['role']
        self.password_expire_max = module.params['password_expire_max']
        self.password_expire_min = module.params['password_expire_min']
        self.umask = module.params['umask']
        if self.umask is not None and self.local:
            module.fail_json(msg="'umask' can not be used with 'local'")
        if module.params['groups'] is not None:
            self.groups = ','.join(module.params['groups'])
        if module.params['expires'] is not None:
            try:
                self.expires = time.gmtime(module.params['expires'])
            except Exception as e:
                module.fail_json(msg="Invalid value for 'expires' %s: %s" % (self.expires, to_native(e)))
        if module.params['ssh_key_file'] is not None:
            self.ssh_file = module.params['ssh_key_file']
        else:
            self.ssh_file = os.path.join('.ssh', 'id_%s' % self.ssh_type)
        if self.groups is None and self.append:
            
            
            module.warn("'append' is set, but no 'groups' are specified. Use 'groups' for appending new groups."
                        "This will change to an error in Ansible 2.14.")
    def check_password_encrypted(self):