Chroot to --store on initialization

We now chroot to the --store directory as soon as we can and then
drop privileges. This is a security benefit, and also has the
advantage that there is no need for the rest of the program to be
told what the store directory is. We just change to it at the start
and then everything is done relative to the current working directory.

Note that this means that the executable must be owned by root:wheel
and must have the setuid bit set. TODO: some sort of build mechanism
to automatically do this.