Privileged group access via incomplete _uid drop

Privilege boundary failure in amoffat sh before 2.2.4 allows local users to retain privileged group access via the _uid option. In sh.py, the _uid privilege-drop path does not fully reinitialize the child process's target GID and group membership before setuid; the fixing commit adds an explicit os.setgid(target_gid) step alongside initgroups to stop inherited privileged group access from surviving. Exposure is limited to Linux and Unix-like deployments that launch commands from a privileged parent and treat _uid as a security boundary, allowing affected children to keep access to files or resources granted through privileged groups.