Add a GUI for manipulating sudo 'run as' policy.

This includes a fair bit of refactoring to allow
the gui to properly display nonstandard sudo members
like %groupname.

Change-Id: I0c2c9318f5469b3a127b1de03524f06d869df72e