polkit doesn't work inside docker.

Since bonafide was not catching the error 401, an attempt to bootstrap a
provider that does not support anonvpn with the new setup was resulting
in a json that was containing only an error message.

this was producing an error when trying to access the configuration for
that provider's EIP section.

we now avoid writing a json config file if an error 401 is found, and
also catch the exception for a ValueError when the EIP section is not
found in the provider's configuration.

for some usages, specially with autostart enabled, user might want to
launch only the systray.

this commit implements a simple ``--nowindow`` switch that just avoids
showing the main window for now. in the future, we can have a different
entrypoint that just launches bitmaskd and a minimal systray widget.

I'm not documenting this feature properly since I think this is still
missing some functionality: the ability to switch on and off the vpn,
and the ability to pass the --autostart as a flag to the bitmask
entrypoint.

also refactor and move polkit_agent so that it does not depend on having
bitmask on the path.