bugz/cli.py: Use a shell-enabled subprocess for the passwordcmd

This allows correct handling of quoting and pipes in the command, as currently
something like `gpg2 --decrypt "my bugzilla credentials.gpg" | head -n1`
utterly fails.

For convenience, only the first line of output is kept as password (assumption:
passwords don't contain newlines; this would save the call to head in the
example above).