Add support for running services inside a PAM session

[troglobit]

Apply a PAM session to run/task/sysv/services Finit starts, pam_limits above all, so a service running as a given user picks up that user's limits the way a login does.

Add a new pam setting for the new block format (only), like the per-service directories, naming a file in /etc/pam.d:

service weston {
    user    = "weston"
    pam     = "weston-autologin"
    command = "/usr/bin/weston --continue-without-input"
}

pam_close_session() has to be called by a process still holding the handle, and the handle does not survive exec(). Hence the keeper: it holds the handle, drops to the service's credentials, and waits for a parent-death signal before closing the session. Same shape as systemd's (sd-pam), for the same reason, and one per fork, so the script hooks open and close their own.

The keeper closes the descriptors it inherited from Finit and only those. Closing everything would also take out what pam_open_session() opened for itself, a keyring fd or a lock file, and leave the modules to close a session with those pulled out from under them. Closing nothing, as (sd-pam) does, would leave it holding the write end of the notify pipe for the service's whole lifetime and starve notify = "s6" services of their ready signal. So the fds open before pam_start() are snapshotted and exactly those are closed, while the ones PAM opens after are marked close-on-exec so the daemon does not inherit them either.

A refused value, a denied account stack, an uninstalled pam.d/ file, and a build without PAM support all keep the service from starting rather than running it with the stacks skipped: one that quietly loses pam_limits and its private /tmp, with nothing said. Capabilities a module like pam_cap.so granted are merged into the IAB Finit applies instead of being replaced by it, which only helps a service that also sets capabilities, the other arm being a plain setuid() with nothing left to restore once permitted is empty.

The test sysroot gains pam_permit.so, pam_deny.so and pam_limits.so, which ldd cannot see, libpam dlopen()s them, and the test skips when the host has none to stage. The negative cases pin the exit status rather than only asserting crashed, which serv reports for any early exit, so a bad command or an unwritable pidfile cannot pass for a rejected session.

[troglobit]

@liuming50 here's a proposal for your feature request #420 slated for v5.0. I hope it meets your expectations, and I'd be very grateful if you could have a look and let me know what you (all) think about the shape and implementation.