bug#51327: 28.0.60; emacsclient warns about XDG_RUNTIME_DIR when starting daemon on-demand

[Jim Porter]

Normally, when running `emacsclient --alternate-editor=""' with no Emacs 
server running, it will run `emacs --daemon' and then connect to it. In 
Emacs 28, it will also issue the following warning:

  Should XDG_RUNTIME_DIR='/run/user/1000' be in the environment?
  (Be careful: XDG_RUNTIME_DIR is security-related.)

However, XDG_RUNTIME_DIR *is* set in my environment, so it shouldn't be 
warning me about it.

I believe this is due to the fix for bug#33847 (see commit 
007744dd0404d6febca88b00c22981cc630fb8c0). That bug asked for 
emacsclient to look in both XDG_RUNTIME_DIR and TMPDIR to find the 
server socket, in order to accommodate the case where `emacs --daemon' 
is started when XDG_RUNTIME_DIR is unset, but *is* set when running 
`emacsclient'.

That works for the issue described in bug#33847, but for users with 
XDG_RUNTIME_DIR set who want `emacs --daemon' to start on demand, the 
change means that emacsclient will look in TMPDIR to find a server 
socket, record that attempt, and then warn about it before finally going 
ahead and starting `emacs --daemon'.

I'm not an expert on XDG_RUNTIME_DIR, but my understanding is that this 
was added to improve security over using TMPDIR. However, as far as I 
can tell, the fix in bug#33847 partially undoes the security improvement 
for users who want to start `emacs --daemon' on demand.

I'm not sure what the fix here is, at least not while ensuring that both 
this case and the case in bug#33847 "just work" without setting some 
option...

(The original bug#33847 is rather long, and I see that similar concerns 
were raised there, so I hope I've summarized this accurately and I'm not 
just misunderstanding what this code is doing.)