I've seen a false positive because journalctl was run too early: the Journal
output for this scenario, saved as a test suite artifact, actually shows that
the expected denial occurred.

I think that when we use this step after "I do not see […]", which calls
waitVanish, Cucumber + Sikuli can possibly win the race against systemd-journald
and then we expect a log message that was not registered yet.

So, let's try up to 10 times to find the log message we want and drop the
ability to customize that delay (which is not used anywhere).