Display the lecture immediately before prompting for a password.

This means we no longer display the lecture unless the user is going
to enter a password.  Authentication methods that don't interact
with the user via the terminal don't trigger the lecture.

plugins/sudoers/auth/sudo_auth.c

@@ -44,6 +44,7 @@
 #include "sudoers.h"
 #include "sudo_auth.h"
 #include "insults.h"
+#include "check.h"
 
 static sudo_auth auth_switch[] = {
 /* Standalone entries first */
@@ -443,6 +444,9 @@ auth_getpass(const char *prompt, int type, struct sudo_conv_callback *callback)
     sigset_t mask, omask;
     debug_decl(auth_getpass, SUDOERS_DEBUG_AUTH);
 
+    /* Display lecture if needed and we haven't already done so. */
+    display_lecture(callback);
+
     /* Mask user input if pwfeedback set and echo is off. */
     if (type == SUDO_CONV_PROMPT_ECHO_OFF && def_pwfeedback)
 	type = SUDO_CONV_PROMPT_MASK;