PGBackend: fix and clarify be_select_auth_object

PGBackend: fix and clarify be_select_auth_object

Previously, auth would end up containing every object without a
self-evident defect -- even if they did not match each other.  Instead
of filtering out the non-matching items there, be_compare_scrubmaps now
returns one valid object and be_compare_scrubmaps gathers the other
which match it.

We can be smarter by doing this in be_select_auth_object and selecting
the largest matching set, but for now this is simpler.

Fixes: 10524
Signed-off-by: Samuel Just <sjust@redhat.com>