The promise runner launched in a subprocess with the instance's python
redirects stderr to stdout in order to reserve stderr for propagating
error messages.

However `preexec_fn` is used to run `dropPrivileges` inside the child
process, so when `dropPrivileges` calls `logger.debug`, the logger
writes to stderr before the redirection is set up.

To fix this, the `preexec_fn` function is modified to apply the same
redirection first and revert it at the end. Reverting it avoids the
need to communicate the new file descriptor for the original stderr
stream to runpromise.py.