spawn with sudo

instead of setuid

allows better restricted access, and doesn't require the user to be root.

Enable with `--LocalProcessSpawner.set_user=sudo`