Call initgroups() when dropping privilege, in order that Exim runs with