supervisor: Deny setgroups before writing the gid map

The fix for CVE-2014-8989 is likely to break Sandstorm without this
change.