polkit doesn't work inside docker.

Since bonafide was not catching the error 401, an attempt to bootstrap a
provider that does not support anonvpn with the new setup was resulting
in a json that was containing only an error message.

this was producing an error when trying to access the configuration for
that provider's EIP section.

we now avoid writing a json config file if an error 401 is found, and
also catch the exception for a ValueError when the EIP section is not
found in the provider's configuration.

also refactor and move polkit_agent so that it does not depend on having
bitmask on the path.

for now, we'll be hardcoding tcp as a more reliable alternative, no
matter what the provider announces.

explicitely specifying ipv4 should fix the case in which vpn fails to
start because ipv6 is disabled.

-Resolves: #9181, #9129

honor the anonymous certificate for the providers that offer it.
this still needs a change in bonafide, in which if provider supports
anonymous access we still have to download eip-service.json

for testing, I assume this has been already manually downloaded.