move "unix" pledge promise from gotd parent to auth process The listen process now communicates the client UID/GID to the parent, and the auth process verifies this on behalf of the parent. This allows us to remove the "unix" pledge promise from the parent, removing parent access to syscalls such as listen() and accept() in the AF_UNIX domain. ok tracey@ op@

run gotd authentication in a separate child process ok op@

getpwuid() returns NULL without setting errno if no user is found pointed out by millert@

zap double grp.h include spotted by Thomas

fix group membership check in gotd auth ok op@

implement per-repository read/write authorization rules in gotd ok op@