[rfe] StartTransientUnit for superuser bridge

[allisonkarlitskaya]

Right now we more or less become root by using sudo, via the "bridge configuration" mechanism in manifest files (and specifically pkg/shell/manifest.json). We also have pkexec support, and run0 support is added by #22373.

I have an experimental PR in allisonkarlitskaya/systemd_ctypes#83 that shows that run0 isn't so complicated. It more or less boils down to a call to StartTransientUnit with some plumbing for stdin/-out/-err. I've tested, and this works with RHEL 8.8 (and presumably everything in between).

Meanwhile run0 is a bit annoying to wrap because among other things it generates bad error messages. We can't plausibly show something like "Failed to start transient unit: Access Denied" to the user. If we call the D-Bus API directly then we get access to the error codes and can display better/localized messages. The polkit agent interaction comes from the existing code that we have for pkexec.

I think we should do this via some mechanism like retconning a "method" field into our bridge configs with values like "spawn" (default) and "transient-unit". In case "method": "spawn" (the default) we look at the "spawn" key for the command to exec (which is the current behaviour). If it's "transient-unit" then we call StartTransientUnit on systemd via the system bus instead.

[allisonkarlitskaya]

As with the current #22373 we'd probably keep sudo as the default for now, but using systemd directly to run the privileged bridge as a transient unit without any need for an external helper program (or any setuid binaries) is so obviously superior in the longterm that we will need to come up with a way to migrate to it as the default, while giving a mechanism to go back to sudo for those who want it...