A first attempt at Feature#1899

WIP - [redmine#1899](https://cfengine.com/dev/issues/1899):  could use a second glance/opinion on what's in the patch so far.

Here's a couple runs using a slightly modified `package_method npm`; you can clearly see the `uid` and `gid` being changed before executing the package manager:
https://gist.github.com/cdituri/7077583

Oddly enough `npm` references a lock file in `/root/.npm/` even though the command drops priviledge... maybe a bug in `npm` or I need to look into the `setuid / seteuid / setreuid` family further (???). Not sure, still needs more testing... some different package manager runs.