[Ar-maan05]

sudoreplay -l can list sessions that don't match the search when a field is missing from the log. a run group is only logged when it differs from the run user's primary group, so plenty of logs don't have it. for a session by alice with no run group:

$ sudoreplay -l user alice group wheel
before: lists the session
after:  nothing

$ sudoreplay -l user alice ! group wheel
before: nothing
after:  lists the session

res was only set when the field was there, so a missing field reused the result of the previus term. the fix resets it for each term.

tested with a small hand-written log.json before and after. plain searches like user alice and user alice host h give the same results as before. there's no sudoreplay regress dir so i didn't add a test.

[millert]

Looks good, thanks.