MFC r281800 (pfg):

patch(1): small include changes.

Mostly to match OpenBSD, no functional change.

MFC r286601 + 286617:

use posix_spawn(3) instead of fork() and exec() manually as suggested
by jmg@.

Fix patch(1) shell injection vulnerability. [SA-15:14]

Fix resource exhaustion in TCP reassembly. [SA-15:15]

Fix OpenSSH multiple vulnerabilities. [SA-15:16]

MFC r281800 (pfg):

patch(1): small include changes.

Mostly to match OpenBSD, no functional change.

MFC r286601 + 286617:

use posix_spawn(3) instead of fork() and exec() manually as suggested
by jmg@.

Fix patch(1) shell injection vulnerability. [SA-15:14]

Fix resource exhaustion in TCP reassembly. [SA-15:15]

Fix OpenSSH multiple vulnerabilities. [SA-15:16]