Add support for specifying an explicit group when dropping privileges.

This simplifies my use of pf(4) when using group-based
rules to exclude splitssl from redirection.
Merge branch 'macosx-yosemite' into fix-macosx
Merge branch 'specify-custom-gid' into fix-macosx
Merge branch 'fix-macosx' into macosx-process-info
Wire up lookup of the local process/socket originating the proxied connection.

This uses Mac OS X's libproc to find the first process that owns
a matching socket. Currently, the results are simply logged;
the next step will be exposing this generically via
the NAT engine lookup API.