Properly render hits and misses

[egibs]

Closes: #623

This PR allows for hits and misses surfaced by --err-first-hit or --err-first-miss to be displayed while also preventing additional concurrent processing/rendering of other paths.

This is achieved with a separate goroutine that reads from a channel that stores only the first match returned by errIfHitOrMiss and propagates the match and error properly.

Example output:

$ for i in (seq 1 5); go run cmd/mal/mal.go --err-first-miss analyze /Library/Application\ Support/BTServer/; end
🔎 Scanning "/Library/Application Support/BTServer/"
👋 no matching capabilities in "/Library/Application Support/BTServer/pincode_defaults.db" kind=file suffix=: matched requested condition
🔎 Scanning "/Library/Application Support/BTServer/"
👋 no matching capabilities in "/Library/Application Support/BTServer/pincode_defaults.db" kind=file suffix=: matched requested condition
🔎 Scanning "/Library/Application Support/BTServer/"
👋 no matching capabilities in "/Library/Application Support/BTServer/pincode_defaults.db" kind=file suffix=: matched requested condition
🔎 Scanning "/Library/Application Support/BTServer/"
👋 no matching capabilities in "/Library/Application Support/BTServer/pincode_defaults.db" kind=file suffix=: matched requested condition
🔎 Scanning "/Library/Application Support/BTServer/"
👋 no matching capabilities in "/Library/Application Support/BTServer/pincode_defaults.db" kind=file suffix=: matched requested condition

$ for i in (seq 1 5); go run cmd/mal/mal.go --err-first-hit analyze /usr/bin; end
🔎 Scanning "/usr/bin"
├─ 🔵 /usr/bin/SafeEjectGPU [LOW]
│     ≡ networking [LOW]
│       🔵 url/parse — Handles URL strings: NSURL
│
👋 1 matching capabilities in /usr/bin/SafeEjectGPU file: net/url/parse: matched requested condition
🔎 Scanning "/usr/bin"
├─ 🔵 /usr/bin/SafeEjectGPU [LOW]
│     ≡ networking [LOW]
│       🔵 url/parse — Handles URL strings: NSURL
│
👋 1 matching capabilities in /usr/bin/SafeEjectGPU file: net/url/parse: matched requested condition
🔎 Scanning "/usr/bin"
├─ 🔵 /usr/bin/AssetCacheManagerUtil [LOW]
│     ≡ filesystem [LOW]
│       🔵 file/write — writes to file: writeToFile:atomically:
│
👋 1 matching capabilities in /usr/bin/AssetCacheManagerUtil file: fs/file/write: matched requested condition
🔎 Scanning "/usr/bin"
├─ 🟡 /usr/bin/AssetCacheLocatorUtil [MEDIUM]
│     ≡ networking [MEDIUM]
│       🟡 ip/addr — mentions an 'IP address'
│
👋 1 matching capabilities in /usr/bin/AssetCacheLocatorUtil file: net/ip/addr: matched requested condition
🔎 Scanning "/usr/bin"
├─ 🔵 /usr/bin/SafeEjectGPU [LOW]
│     ≡ networking [LOW]
│       🔵 url/parse — Handles URL strings: NSURL
│
👋 1 matching capabilities in /usr/bin/SafeEjectGPU file: net/url/parse: matched requested condition

[tstromberg]

Can we simplify the exit messages? Instead of:

👋 no matching capabilities in "/Library/Application Support/BTServer/pincode_defaults.db" kind=file suffix=: matched requested condition
👋 1 matching capabilities in /usr/bin/SafeEjectGPU file: net/url/parse: matched requested condition

How about something closer to:

👋 /Library/Application Support/BTServer/pincode_defaults.db matched exit criteria
👋 /usr/bin/SafeEjectGPU matched exit criteria

In the second case, in particular, we can already see the list of capabilities just above this line. Eventually we should rename these flags to --exit-if instead of --err-if - that can be done here or in another PR.

[egibs]

Can we simplify the exit messages? Instead of:

👋 no matching capabilities in "/Library/Application Support/BTServer/pincode_defaults.db" kind=file suffix=: matched requested condition
👋 1 matching capabilities in /usr/bin/SafeEjectGPU file: net/url/parse: matched requested condition

How about something closer to:

👋 /Library/Application Support/BTServer/pincode_defaults.db matched exit criteria
👋 /usr/bin/SafeEjectGPU matched exit criteria

In the second case, in particular, we can already see the list of capabilities just above this line. Eventually we should rename these flags to --exit-if instead of --err-if - that can be done here or in another PR.

Updated in c949cc4 (#624).

Renamed the errIfHitOrMiss function in 2f68252 (#624) as well.