open the secret file immediately for the -S option

The varnish-agent will usually be run as a daemon, executed by a systemd
or upstart or sysv or <put your favourite system here> service as root.
The problem is that varnish-agent will attempt to open the secret file
after giving up its privileges (setgid and setuid) and won't be able to
open a secret file with a 400 or 600 mode that should be owned by root.

If the -S option was not found on the command line, the varnish agent
will search for it in the shared memory log. Assuming varnishd is
running on the same machine, varnish-agent is very likely to have a read
access to the shmlog.