sudo: add GUI option and template

[AdSchellevis]

From https://forum.opnsense.org/index.php?topic=3151

Up for debate, we could easily add an extra acl and check for uid 0 or "wheel-shell-user" access in here https://github.com/opnsense/core/blob/master/src/etc/inc/auth.inc#L431-L436 .

It provides admins with the possibility to create "real" admin users which can do practical the same as root.

[fichtner]

Cloning the root account has no security benefit and people have been annoyed by the console menu in other accounts, which still requires super user rights to run. ;)

Wheel group is added to admins already, but that requires "su" and the root account password. Instead, sudo can be set up to allow wheel group to run super user commands, so "sudo su" will either prompt for the account's own password or not at all. Execution will bring up the console menu as a root-like user and problem fixed...

This requires a sudoers template with the options (a) off (default) (b) on, requires password (c) on, requires no password.

Also, when the root account is disabled we should scramble the system password on each boot, because we cannot truly disable (nologin) because that gets rid of the root menu.

Long story short, there should only ever be one root and people must use sudo if they want to wheel, it's really best practice for any UNIX-like system. The GUI is not affected by this enhancement.

[AdSchellevis]

I kind of forgot about wheel already being assigned to the admin user, lets keep things like they are now, which probably is easy enough to handle for most people.

[fichtner]

reopening for sudo settings...

[fichtner]

/usr/local/etc/sudoers.d/ seems perfect to make this finally happen :)