Sync with recent upstrean changes:
---8<-------------------------------------------------------------
Call pledge(2) earlier before opening the auth channel and readpassphrase()
Before this change, only the password validation was pledged, now it
also includes some more code including the "Password:" prompt.
To pledge the code earlier, the getpwnam_shadow() had to be moved up -
it works under "getpw" but it does not return the actual password hash
under pledge. This also works with yp(ldap).
OK deraadt@ tb@ brynet@
---8<-------------------------------------------------------------