supervisor: Deny setgroups before writing the gid map

The fix for CVE-2014-8989 is likely to break Sandstorm without this
change.
Merge pull request #187 from amluto/master

supervisor: Deny setgroups before writing the gid map