netstat: strip the binary of sgid

Everything in the live path seems to use sysctls these days, with kvm
only being used for pulling information from core dumps. Strip the
binary of /dev/{k,}mem access to reduce the surface area with access
to kmem.

Reviewed by: glebius, markj
Differential Revision: https://reviews.freebsd.org/D47210