Fedora and pkexec

1. Split polkit & pkexec
2. Have polkit rules be more sane

Further, either

a) move an increasing amount of stuff from sudo to pkexec (or even build a drop-in binary with a one-time translation of sudoers to policykit rules); or
b) make a suid replacement mechanism with opt-in state?

(a) seems more likely to happen, I think.