now it's symmetrical to listener_main().

FRC3875 says that if the query does not contain any unecnoded "=" characters, we SHOULD treat the query string as a "search-string", split in on "+" and add every word to the CGI argv. In launch_cgi it's too late because iri->query is the *decoded* query! I have in mind some refactoring around how we decode things, so this is postponed.

Oh my, this is such a stupid mistake. It went undiscovered only because I always used CGI scripts on the first vhost (and hence the offset would be 0) and never on the others.

while there also add SERVER_PROTOCOL

when we switched from one process to two, I introduced a small optimisation: empty string are not send, so we receive NULL. Constructing requri we need to make sure that relpath is not null.

this way, we can sandbox the listener with seccomp (todo) or capsicum (already done) and still have CGI scripts. When we want to exec, we tell the executor what to do, the executor executes the scripts and send the fd backt to the listener.