Add SETENV support

[squell]

Closes #760

Also Closes #546, since we add parsing+warning support for things like NOEXEC and TIMEOUT.

This does not add support for --preserve-env or --preserve-env=VAR. I think the former needs some more discussion since it is the same as disabling env_reset. The latter is not controversial for us but better part of a separate PR.

This can be reviewed commit-by-commit if desired.

[squell]

Note that this implementation is slightly different from ogsudo, as indicated by the (non-)compliance test case in can_surprisingly_be_set_from_commandline that is explicitly ignored. Both sudo-rs and sudo-c treat (NO)SETENV like (NO)PASSWD; that is, it acts like an on/off switch for a single line and can apply to multiple commands following it.

However, there is an exception in that ALL has an implicit SETENV unless it is explicitly marked as NOSETENV. In ogsudo, this exception applies to any ALL, even one that appears to be 'ruled' by a more distant NOSETENV like so:

... NOSETENV: /path/to/some/command, ALL

sudo-rs will not allow environment control in this case--this is more predictable/logical (it says "NOSETENV", right?) and is also the 'fail safe' condition (this will cause noticeable errors if someone relies on this behaviour in sudo-c, instead of silently granting more privileges to users than might be expected). The above line is in fact a dubious configuration in any case since the ALL will subsume the previous /path/to/command.