Adjust rules for search_path so that pg_catalog is never implicitly

selected as the creation target namespace; to make that happen, you
must explicitly set search_path that way.  This makes initdb a hair
more complex but seems like a good safety feature.