Protect the SU binary

The ITHC has identified that anyone can run SU. This commit
restricts that to only the root user and the members of the
gds group.