bectl(8): Allow running a custom command in the 'jail' subcommand

Instead of always running /bin/sh, allow the user to specify the command
to run. The jail is not removed when the command finishes. Meaning,
bectl unjail will still need to be run.

For example:

bectl jail newBE pkg upgrade
bectl ujail newBE

Submitted by: Shawn Webb
Obtained from: HardenedBSD (8b451014ab)