This moves the setuid root from the main screensaver process to a smaller
auth process (it uses getpwnam_shadow for user db access, there is no
driver for bsd-auth). I've tried it with setgid _shadow instead of
setuid root but unlock is broken in that case.
This is better than it was previously, but still not ideal. I suggest
the ports version of slock (not upstream's; we had to add bsd-auth support
back in via a patch after upstream removed it again) or xlock.
Add some notes to the Makefile describing the current situation in case
somebody wants to improve it (it should be possible to add a bsd-auth
driver to this instead).
35395000af