audio/shairport-sync: use pledge

There are three pledges:
- at the start
- after daemon(3) to drop "proc exec" unless scripts are used
- after sio_open(3) to drop "cpath dpath" unless metadata is used

Our port has libdaemon and metadata disabled, so it always ends up with
"stdio rpath wpath inet unix dns [proc exec] audio", but the diff does
account for them, such that enabling them does the right thing.

One might be able to drop more and/or use unveil(2), but that needs
careful hoisting and consideration of other features our port currently
does not enable.

Feedback? Objection? OK?

Index: Makefile
===================================================================
RCS file: /cvs/ports/audio/shairport-sync/Makefile,v
diff -u -p -r1.7 Makefile
--- Makefile 31 Jan 2024 08:47:23 -0000 1.7
+++ Makefile 5 Feb 2024 11:45:53 -0000
@@ -1,7 +1,7 @@
COMMENT = AirPlay audio player

DIST_TUPLE = github mikebrady shairport-sync 4.3.2 .
-REVISION = 0
+REVISION = 1

CATEGORIES = audio net

Index: patches/patch-shairport_c
===================================================================
RCS file: patches/patch-shairport_c
diff -N patches/patch-shairport_c
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-shairport_c 5 Feb 2024 12:04:21 -0000
@@ -0,0 +1,75 @@
+Index: shairport.c
+--- shairport.c.orig
++++ shairport.c
+@@ -1929,6 +1929,12 @@ void _display_config(const char *filename, const int l
+ #define display_config(argc, argv) _display_config(__FILE__, __LINE__, argc, argv)
+
+ int main(int argc, char **argv) {
++#if defined(__OpenBSD__)
++ /* Start with the superset of all potentially required promises. */
++ if (pledge("stdio rpath wpath cpath dpath inet unix dns proc exec audio", NULL) == -1)
++ die("pledge: %s", strerror(errno));
++