ssh/tailssh: only chdir incubator process to user's homedir when necessary and possible

Instead of changing the working directory before launching the incubator process,
this now just changes the working directory after dropping privileges, at which
point we're more likely to be able to enter the user's home directory since we're
running as the user.

For paths that use the 'login' or 'su -l' commands, those already take care of changing
the working directory to the user's home directory.

Fixes #13120

Signed-off-by: Percy Wegmann <percy@tailscale.com>

ssh/tailssh/tailssh_integration_test.go

@@ -122,13 +122,13 @@ func TestIntegrationSSH(t *testing.T) {
 		{
 			cmd:             "pwd",
 			want:            []string{homeDir},
-			skip:            !fallbackToSUAvailable(),
+			skip:            os.Getenv("SKIP_FILE_OPS") == "1" || !fallbackToSUAvailable(),
 			forceV1Behavior: false,
 		},
 		{
 			cmd:             "echo 'hello'",
 			want:            []string{"hello"},
-			skip:            !fallbackToSUAvailable(),
+			skip:            os.Getenv("SKIP_FILE_OPS") == "1" || !fallbackToSUAvailable(),
 			forceV1Behavior: false,
 		},
 	}