Ensure PATH propagates through privilege drops

For the new Docker image to work properly, the PATH variable needs
to propagate through user changes performed by `nav start` commands.
There were, however, two barriers:  First, su is used to drop privileges
before starting nav daemons, but this resets the PATH variable to
the ones defined in `/etc/login.defs`.  Secondly, `nav start` uses
a `-` to tell `su` to use a login shell, in which case the PATH is still
reset.  The login shell option was introduced by a fix for #2218, but
it's not clear that the use or non-use of a login shell was the actual
problem solved, it was just that the order of the arguments needed to
be portable.

Tagged #2218 just in case this turns into another BSD regression.

Author: lunkwill42

Dockerfile

@@ -86,7 +86,10 @@ ARG UID
 ARG GID
 RUN groupadd --gid "$GID" nav ; adduser --home=/source --shell=/bin/bash --uid=$UID --gid=$GID nav
 RUN echo "nav    ALL =(ALL: ALL) NOPASSWD: ALL" > /etc/sudoers.d/nav
+# Ensure the virtualenv's bin directory is on everyone's PATH variable
 RUN sed -e 's,^Defaults.*secure_path.*,Defaults        secure_path="/opt/venvs/nav/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",' -i /etc/sudoers
+RUN sed -e 's,^ENV_SUPATH.*,ENV_SUPATH      PATH=/opt/venvs/nav/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",' -i /etc/login.defs
+RUN sed -e 's,^ENV_PATH.*,ENV_PATH        PATH=/opt/venvs/nav/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games",' -i /etc/login.defs
 
 RUN --mount=type=cache,target=/source/.cache \
     mkdir -p /opt/venvs/nav && chown nav /opt/venvs/nav && \

python/nav/startstop.py

@@ -126,7 +126,7 @@ def start(self, silent=False):
         if not self.service_dict.get("privileged", False):
             # run command as regular nav user
             user = NAV_CONFIG.get("NAV_USER", "navcron")
-            command = 'su - {user} -c "{command}"'.format(
+            command = 'su {user} -c "{command}"'.format(
                 command=self._command, user=user
             )
         else: