pledge "stdio rpath getpw proc exec id" at start, much like doas.

pledge "stdio rpath getpw proc exec id" at start, much like doas.
2 further pledges are possible, not as many as doas can do, because the
order of some su operations is a bit different.  also it is trying
harder to please non-root nfs mounts?