fix parent-memory-clobber in posix_spawn (environ)

use restrict everywhere it's required by c99 and/or posix 2008

to deal with the fact that the public headers may be used with pre-c99
compilers, __restrict is used in place of restrict, and defined
appropriately for any supported compiler. we also avoid the form
[restrict] since older versions of gcc rejected it due to a bug in the
original c99 standard, and instead use the form *restrict.

fix various errors in function signatures/prototypes found by nsz

initial implementation of posix_spawn

file actions are not yet implemented, but everything else should be
mostly complete and roughly correct.