Calling setuid before setgid does not, even when starting as root, and
results in a startup error. This is because, after the process has
switched to an unprivileged user with setuid, it does not has the rights
to call setgid (even with its own group) unless it has CAP_SETGID.

In addition, this commit calls setgroups to drop any supplementary
groups the process may have. HAProxy does the same thing.

golang.org/x/mod v0.38.0
golang.org/x/net v0.57.0
golang.org/x/sys v0.47.0
golang.org/x/crypto v0.54.0
golang.org/x/sync v0.22.0
golang.org/x/text v0.40.0
golang.org/x/tools v0.48.0

github.com/aws/aws-sdk-go-v2 v1.42.1
github.com/aws/aws-sdk-go-v2/config v1.32.30
github.com/aws/aws-sdk-go-v2/credentials v1.19.29
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.69.1
github.com/aws/aws-sdk-go-v2/service/ec2 v1.316.1
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30
github.com/aws/aws-sdk-go-v2/service/route53 v1.64.1
github.com/aws/aws-sdk-go-v2/service/signin v1.4.1
github.com/aws/aws-sdk-go-v2/service/sso v1.32.1
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.1
github.com/aws/aws-sdk-go-v2/service/sts v1.44.1
github.com/aws/smithy-go v1.27.4