If NetworkManager decides that a wireless connection has timed out
before "supplicant connection state" has occued, our idea of the state
is `undef`, so it cannot be used in a string comparison. Hence, let's
initialize the state to the empty string instead of `undef`.

Will-fix: #7689

Now we call it tails-restricted-network-detector instead, to avoid
confusion with the term "blocked network" used with a completely
different meaning that's also in the MAC spoofing context (see
e.g. tails-unblock-network).

The system() call has many issues, probably not relevant here, but
runx() is always safer.

Since we enable MAC spoofing by default, users may experience network
connection issues on networks emplying MAC address blocking.
Unfortunately NetworkManager does not seem to offer any nice hook into
its error-handling, so when MAC spoofing is enabled we run (from T-G)
this crufty script which analyzes NM's log and tries to identify
connection failures that is unrelated to more common errors, like
entering an incorrect WPA passphrase. At the moment the script only
handles wifi networks, not wired, WAN, etc.