pax(1): Honour the restrict in sigaction().

Use a setup_sig() helper and make it fail when either of sigaction fails.

While there, do not leak fds for "." + minor cleanup.

Obtained from: OpenBSD (through DragonFly git eca362d0f9bd086cc56d6b5bc4f03f09e040b9db)