Add `:bsexec` option to `command.run`

* Similar to `:sudo`, gives the ability to run an external command
  within a given context.
* Exposes `:bsexec` in DSL; not yet documented
* Fixes #7132 (mount dmg image fails if user does not have StartupItemContext(8))