Add pledge support in awk and make awk -safe actually safe.

Add pledge support in awk and make awk -safe actually safe.

awk -safe was introduced back in 1997 to stop awk from doing file output,
execute commands or access the environment.  The lexer rejected programs
when it saw awk commands that would write, exec or env.  Beyond that,
it wasn't safe from write/exec/env during program execution.

With pledge "stdio rpath", the kernel is now enforcing the awk -safe
mode restrictions at runtime (other than env).

Based on a diff by deraadt@

ok deraadt@ beck@