session: Make sure our auth file descriptor gets closed on exec

We never want the auth file descriptor to leak to the unpriveleged
cockpit-agent. Although we close all extra file descriptors before
execing(), this is a double insurance against future refactoring.

Closes #1225
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>
shell: Rules for overflow of user account boxes.

Fixes #1211
Closes #1231
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>