This prevents the undefined behaviour that would come up as a result of
doing so. (For example: opening "infinite" devices like /dev/full will
result in an infinite loop until exhaustion of memory)
Now that WindowServer broadcasts the system theme using an anonymous
file, we need clients to pledge "recvfd" so they can receive it.
Some programs keep the "shared_buffer" pledge since it's still used for
a handful of things.
