Update nightwatch75/dns-switcher to 0.1.2 — fix #292 review notes (#319)

Addresses the three non-blocking notes from #292:

- README's plugin_api requirement was stale (22) vs the manifest's real
  minimum (17, the onExit lifecycle addition) — corrected, and pinned the
  noctalia version floor to beta.7 (the first tagged release plugin_api
  actually reaches 17 in).
- apply()'s privilege path ran the whole discovery+mutate script through
  `priv sh -c '...'`, which the documented sudoers rule (NOPASSWD:
  /usr/bin/nmcli) never covers — sudo -n always failed. Now the privilege
  prefix is applied to each of the two mutating nmcli calls individually,
  never to a wrapping shell.
- Regenerated thumbnail.webp.

Co-authored-by: nightwatch75 <nightwatch75@users.noreply.github.com>

dns-switcher/service.luau

@@ -14,10 +14,13 @@
 -- reapply pushes the change onto the live connection without reactivating
 -- it, so the network never drops. The privilege command is empty by default:
 -- NetworkManager's polkit policy lets active local sessions modify system
--- connections on most desktop distros.
+-- connections on most desktop distros. When set, it is prefixed onto each
+-- of those two nmcli calls individually (never onto a wrapping shell), so a
+-- sudoers NOPASSWD rule naming the nmcli binary itself is enough — see
+-- apply() below and the README's Privileges section.
 
-local STATE_KEY = "dns_state"
-local REQUEST_KEY = "apply_request"
+local STATE_KEY = "dns_state"       -- published here, read by widget + panel
+local REQUEST_KEY = "apply_request" -- sent by widget/panel, consumed here
 
 local BUILTIN = {
     { id = "google",     label = "Google",     ip = "8.8.8.8 8.8.4.4",               glyph = "brand-google" },
@@ -52,10 +55,6 @@ local function trim(value)
     return (value:gsub("^%s+", ""):gsub("%s+$", ""))
 end
 
-local function shellQuote(value)
-    return "'" .. value:gsub("'", "'\\''") .. "'"
-end
-
 local function pollSeconds()
     return math.max(2, tonumber(cfg("poll_seconds")) or 10)
 end
@@ -302,23 +301,26 @@ local function apply(provider)
     else
         mods = 'ipv4.dns "' .. safeIp .. '" ipv4.ignore-auto-dns yes'
     end
-    local inner = 'ACT=$(LC_ALL=C nmcli -t -f TYPE,DEVICE,UUID connection show --active 2>/dev/null); '
-        .. [[LINE=$(printf '%s\n' "$ACT" | grep -E '^(802-11-wireless|802-3-ethernet):' | head -n 1); ]]
-        .. [=[[ -n "$LINE" ] || LINE=$(printf '%s\n' "$ACT" | grep -v '^loopback:' | head -n 1); ]=]
-        .. [=[[ -n "$LINE" ] || exit 9; ]=]
-        .. 'DEV=$(printf \'%s\' "$LINE" | cut -d: -f2); '
-        .. 'UUID=$(printf \'%s\' "$LINE" | cut -d: -f3); '
-        .. 'nmcli con mod "$UUID" ' .. mods .. ' && nmcli device reapply "$DEV"'
 
     local priv = cfg("privilege_command")
     if type(priv) ~= "string" then
         priv = ""
     end
     priv = trim(priv)
-    local cmd = inner
-    if priv ~= "" then
-        cmd = priv .. " sh -c " .. shellQuote(inner)
-    end
+    -- Prefixed onto each nmcli invocation individually, never onto a
+    -- wrapping `sh -c`: the README's sudoers example authorizes the nmcli
+    -- binary itself (NOPASSWD: /usr/bin/nmcli), which never covers a shell
+    -- run under sudo. Discovering the device/uuid stays unprivileged either
+    -- way (it's a plain read), so only the two mutating calls need it.
+    local privPrefix = priv ~= "" and (priv .. " ") or ""
+
+    local cmd = 'ACT=$(LC_ALL=C nmcli -t -f TYPE,DEVICE,UUID connection show --active 2>/dev/null); '
+        .. [[LINE=$(printf '%s\n' "$ACT" | grep -E '^(802-11-wireless|802-3-ethernet):' | head -n 1); ]]
+        .. [=[[ -n "$LINE" ] || LINE=$(printf '%s\n' "$ACT" | grep -v '^loopback:' | head -n 1); ]=]
+        .. [=[[ -n "$LINE" ] || exit 9; ]=]
+        .. 'DEV=$(printf \'%s\' "$LINE" | cut -d: -f2); '
+        .. 'UUID=$(printf \'%s\' "$LINE" | cut -d: -f3); '
+        .. privPrefix .. 'nmcli con mod "$UUID" ' .. mods .. ' && ' .. privPrefix .. 'nmcli device reapply "$DEV"'
 
     changing = true
     publish()