Provide a secure_getenv() equivalent

Glibc provides a non-standard function secure_getenv() (manpage, glibc manual). It is the same as getenv(), except that it returns NULL if "secure execution" is required. See the manpage for the exact definition but in short, if the executable is setuid or similar.

I think Rust should expose a similar function in the standard library. Here's an example scenario (I haven't tried it out, so I might have it wrong):

• A setuid binary.
• The binary depends on a crate. The binary calls a function from the crate before dropping privileges.
• The function in the crate needs to write a temporary file, so to be nice it tries to use the conventional TMPDIR environment variable to pick the directory first.
• Evil user does TMPDIR=/root/.ssh/ ./binary.

If the library uses getenv, then the user managed to trick the binary into writing stuff into /root/.ssh which is a security hazard. If the library uses secure_getenv, then at least this case is prevented.

Start by reading the linked glibc secure_getenv() manpage and manual section, then review this RFC issue's proposed setuid scenario. Define the Rust standard-library API, its secure-execution behavior, and supported platforms, with the security expectations documented and reviewed as the done criteria.