Avoid invoking the shell when both signing and encrypting a message

When a request came in to sign *and* encrypt, we joined the openssl
invocation to sign together with the openssl invocation to encrypt using
a pipe.  This caused run3 to invoke the shell (because of shell
metacharacters).  This leaves RT vulnerable to CVE-2014-7169,
CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6271 collectively
known as "Shellshock."  Because it requires both signing and encryption,
this vulnerability is only exploitable with an unpatched bash, and by
privileged users. CVE-2014-7227 has been assigned for this
vulnerability.

Switch to using the list form of run3 which avoids any use of the shell.

To emulate the pipe, use a loop which takes the STDOUT in $out from the
signing and hands it back to the encryption run as $buf.  The final
output will then be put back into $buf to be returned upstream and
mailed out.
Merge branch 'security/4.2/smime-shellshock' into security/4.2.8-releng
Updated translations from Launchpad
Merge branch 'security/4.2.8-releng' into 4.2-trunk