plugins/sudoers/lookup.c: fix NOTBEFORE to be able to deny

[manner82]

If someone specifies both a NOTBEFORE and a NOTAFTER rule, the NOTAFTER rule always overrided the result of the NOTBEFORE. Let each of them be able to deny.

Example to demonstrate the issue: add something like this to sudoers:
root ALL=(ALL) NOTBEFORE=20270101000000 NOTAFTER=20280101000000 NOPASSWD: /usr/bin/id
(Feel free to modify "root" to your user.)
Run "sudo id", since we are not living in year 2027, my expectation would be a deny.
However what happens is that the notbefore statement's denial will be overwritten by the notafter rule, which accepts the command run.

[manner82]

It has been a regression/behavior change in sudo 1.9.15, commit:

commit e025cca440376d9497496d204184c59be6f8c9cb
Date:   Thu Jun 29 17:30:39 2023 -0600

    Add callbacks to sudoers_lookup() so we can use it in testsudoers.

    Also pass in the time to be used for NOTBEFORE/NOTAFTER checks.

[millert]

Nice find, thanks!