Prohibit running under sudo unless explicitly forced to do so

[peterebden]

We occasionally see people doing this which frankly messes everything up (they end up with a bunch of files owned by root which can't be removed, which they then complain about later). It's also terrible from a security perspective to invoke a tool like Please as root which will execute a heap of other commands and download files etc.

Sudo sets several env vars, so we can just refuse to run if they are set. I've added a flag to force working around it but I assume this shouldn't be necessary.

I guess you could consider this a breaking change, I'd like to not on the basis that this was a terrible idea all along. We can't have this as a config setting because it's effectively too late (by that point we've already done some stuff, e.g. written a log file)