To spawn a child executable on Unix, the parent `fork`s a copy of
itself, then has the child copy set up the environment and `execve` the
new program.

However, we cannot run any OCaml code in the forked child process. This
is because `fork` only duplicates its own domain. To the child, it
appears that all other domains have stopped responding and if it tries
to e.g. perform a GC then the child process will hang.

Therefore, the `fork` and all child actions need to be written in C.
To keep this flexible, this PR adds a new `fork_action` type and lets
the user provide a list of such actions to perform.

Also, make `Process.t` abstract and document that `execve` can only go
last.

Suggested by Patrick Ferris.

We can operate directly on the safe wrapper, which also simplifies the
code a bit.

Also, add a test for `fchdir`.

This simplifies the code a bit.

Also, check the type of the function passed to `Val_fork_fn`.