Use criticial section in WaitPgrp.

A signal race exists in WaitPgrp that could result in a kill
initiated by xsecurelock against a process that does not belong to it.

This race can happen if waitpid has been called for a child that has
already been terminated and SIGTERM is received before the pid has been
reset to 0.

In that case SIGTERM will call kill for a pid that has been already
released to the operating system and could thus have been assigned to a
new process again.

To prevent this, the criticial section blocks SIGTERM and also SIGCHLD
if WaitPgrp is supposed to block until a child status changes. If the
function is supposed to block, sigsuspend() restores SIGCHLD and SIGTERM
again and waits until a signal is delivered. These signals are blocked
and unblocked for each iteration of the loop. This is required to
actually get interrupted/killed by a SIGTERM in non-blocking mode.

If no critical section could be installed due to failure in calling
sigprocmask the old behaviour is kept.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>