Privileged bind helper

[lukaslihotzki]

When RUN_AS_USER is specified, fork off a small privileged helper that does nothing except binding to privileged ports, then immediately drop the privileges, even before starting the runtime.

The helper is small because it contains a tiny amount of code (50 "main" lines of code + 16 lines of code trivial struct mapping) and only uses 2 very basic dependencies (zerocopy and nix). This makes it very easy to audit.

[lukaslihotzki]

A privileged helper to bind via unix sockets is the best solution for services with dynamic listeners, like stalwart-mail.

There are multiple suitable options on how to create that helper. This PR forks, Command::spawn the current binary would also work, or having two separate binaries (a privileged helper that calls Command::exec on the unprivileged main binary passing the unix socket). Having two binaries is optimal to limit supply chain attacks of libraries to the unprivileged user, but may be more complex for users. What do you think, @mdecimus?