sd-bus: add sd_bus_message.verify_destination_id and .destination_ptr

kdbus learned to accept both a numerical destination ID as well as a
well-known-name. In that case, kdbus makes sure that the numerical ID is in
fact the owner of the provided name and fails otherwise.

This allows for race-free assertion of a bus name owner while sending a
message, which is a requirement for bus-proxyd.

Add two new fields to sd_bus_message, and set the numerical ID to
verify_destination_id if bus_message_setup_kmsg() is called for a
message with a well-known name.

Also, set the destination's name in the kdbus item to .destination_ptr
if it is non-NULL.

Normal users should not touch these fields, and they're not publicy
accessible.
bus-proxyd: keep track of names acquired by legacy client

Store names successfully acquired by the legacy client into a hashmap.
We need to take these names into account when checking for send policies.
bus-proxyd: enforce policy for Hello messages
bus-proxyd: enforce policy for name ownership
bus-proxyd: enforce policy for method calls
bus-proxyd: move name list iteration to policy users

We need to figure out which of the possible names satisfied the policy,
so we cannot do the iteration in check_policy_item() but have to leave it
to the users.

Test cases amended accordingly.
bus-proxyd: make policy checks optional

Retrieve the bus owner creds, and when the uid matches the current user's
uid and is non-null, don't check the bus policy.
more bus-proxyd ...