completion of normal commands after --

[Phil Pennock <zsh-workers+phil.pennock@spodhuis.org>]

Folks,

I have a command-wrapper, which can end its own options with '--' per
POSIX, and then _after_ that take the command to be run.  This is
something I see with a lot of modern devops-style tools.

In this case, the tool is aws-vault; one of the sub-commands is 'exec',
which needs a profile-name and which has flags, which can appear before
or after the profile-name.  After the profile-name is the command to be
run, and it's recommended that you use -- before it if the command takes
options of its own, because otherwise the aws-vault _will_ take those as
its own options.

So you might run:
% aws-vault exec profile-foo -n my-command its-flags-and-args

I have it _almost_ working.  I can see it taking parameters for
aws-vault after the profile name, I can see it switching to _normal
execution and tab-completing commands from the path.  The problem comes
with losing tab-completion for my-command's options.

Eg, I should be able to run:
% aws-vault exec website -- ls -<TAB>
and see the tab-completion for the ls(1) command.

Instead, at present, I can tab-complete the first word after the '--'
and no further.  (Without the --, it tab-completes aws-vault's options,
which is unfortunately correct: they'll be stolen).

    (exec)
      _arguments -s -S -C \
        '(-d --duration)'{-d,--duration=}'[duration of temporary or assume-role session]:duration' \
        '(-n --no-session)'{-n,--no-session}'[use master credentials, no STS session]' \
        '(-t --mfa-token)'{-t,--mfa-token=}'[the MFA token to use]: ' \
        '(-j --json)'{-j,--json}'[be an AWS credential helper]' \
        '(-s --server --ec2-server --ecs-server)'{-s,--server,--ec2-server}'[run EC2 metadata server in background for credentials]' \
        '(-s --server --ec2-server --ecs-server)--ecs-server[run ECS credential server in background for credentials]' \
        '--region=[the AWS region]:region:_aws_regions' \
        '--lazy[When using --ecs-server, lazily fetch credentials]' \
        '--stdout[Print the SSO link to the terminal without automatically opening the browser]' \
        '1:profile name:_aws_profiles' \
        '2:: :->wrapped-command' && return

      case "$state" in
      (wrapped-command | '') # '' for the '--' scenario
        shift $CURRENT words
        CURRENT=1
        _normal -p $service
        ;;
      esac
      ;;

Guidance appreciated, and thanks in advance,
-Phil