Bug#1151170: Another independent reproduction

[Marcio Teixeira]

Another independent reproduction, in case it helps with reviewing.

**Environment**: gnome-keyring 51.1 (Debian package 51.1-3, Debian
testing), headless user session (systemd user units, D-Bus session
bus, no graphical session). The `login` collection is locked; there is
no auto-unlock at login.

**Reproduction**: with the collection locked, start 4 `secret-tool
lookup` clients at the same time (or 3 or more `gh auth token` calls,
which go through go-keyring's `Unlock`/`Prompt`).

**Observed** (identical across prompter variants: `gcr-prompter`
absent, `org.gnome.keyring.SystemPrompter` activation pointing at
`/bin/false`, and a functional prompter that answers every prompt as
cancelled, without opening any window):

- one client fails right away (~0.02 s);
- the other 3 stay blocked waiting for `Completed`; with an external
limit of 150 s, they were still blocked at the limit;
- any later client, even alone, also blocks;
- `Dismiss` on a stuck prompt is only accepted from the requesting
connection, so a third party cannot release it;
- restarting the daemon unblocks future clients but not the ones
already waiting, because libsecret/go-keyring do not watch for the
loss of the `org.freedesktop.secrets` owner.

With a single client, the same setup refuses immediately (prompt
dismissed, no hang).

**Reading of the code** (matches the analysis in this issue): in
`daemon/dbus/gkd-secret-unlock.c`, `mark_as_complete` pops the next
item and calls `perform_next_unlock(other)`, which sees the queue is
not empty and enqueues it again, so no request progresses.

The same section is unchanged on `main` when we checked. We would be
glad to retest a build with !92 against this scenario.

**Downstream mitigation** (for others hitting this in headless
sessions): fail-fast guards that refuse before calling the service
while the collection is locked, plus an external monitor that restarts
the daemon when prompts stay pending for more than a few seconds. This
protects future clients only; already blocked clients must be
terminated.

-- 
Marcio Teixeira