Add a new flag "allow_unknown_runas_id" to control matching of unknown IDs.

Previous, sudo would always allow unknown user or group IDs if the
sudoers entry permitted it.  This included the "ALL" alias.
With this change, the admin must explicitly enable support for unknown IDs.

plugins/sudoers/def_data.c

@@ -525,6 +525,10 @@ struct sudo_defs_types sudo_defs_table[] = {
 	"log_server_peer_key", T_STR|T_BOOL|T_PATH,
 	N_("Path to the sudoers private key file: %s"),
 	NULL,
+    }, {
+	"runas_allow_unknown_id", T_FLAG,
+	N_("Allow the use of unknown runas user and/or group ID"),
+	NULL,
     }, {
 	NULL, 0, NULL
     }