Search for setuid programs in the background, and judge each polkit rule alone

A search over a large disk ran inside the look, holding the judge's lock and
stalling the health statement; it now runs apart, serving its last result,
backing off after a failure, and saying not judged until it has one. And a
rule naming a user, or a comment, no longer hides another rule's
unconditional yes (hq ADR 0266).

internal/accounts/exec.go

@@ -110,10 +110,12 @@ func (e Exec) Escalation(ctx context.Context, account string, secrets []string)
 		}
 	}
 	more, err := e.moreWays(ctx, account, uid, names, gids, secrets)
-	if err != nil {
+	var notJudged *SetuidNotJudged
+	if err != nil && !errors.As(err, &notJudged) {
 		return nil, err
 	}
-	return append(ways, more...), nil
+	// Every way found, and — when the setuid search has no result yet — that it is not judged.
+	return append(ways, more...), err
 }
 
 // Readable is whether an account of uid, in the groups gids, reads a file of m by its permission bits, as