Merge "run-as: reduce the scope of changed egid." into main