PAM: reorganize the way pam_ecryptfs and pam_mount get their password
PAM: reorganize the way pam_ecryptfs and pam_mount get their password

Run pam_unix an additional time rather than switching it from sufficient
to required. This fixes a potential security issue for
ecryptfs/pam_mount users as with pam_deny gone, if cfg.unixAuth = False
then it is possible to login without a password.

NixOS/nixpkgs,SymbiFlow/nixpkgs,NixOS/nixpkgs,NixOS/nixpkgs,triton/triton,SymbiFlow/nixpkgs,NixOS/nixpkgs,NixOS/nixpkgs,SymbiFlow/nixpkgs,triton/triton,triton/triton,NixOS/nixpkgs,NixOS/nixpkgs,NixOS/nixpkgs,SymbiFlow/nixpkgs,triton/triton,NixOS/nixpkgs,SymbiFlow/nixpkgs,SymbiFlow/nixpkgs,triton/triton,NixOS/nixpkgs,NixOS/nixpkgs,NixOS/nixpkgs,triton/triton,SymbiFlow/nixpkgs,SymbiFlow/nixpkgs,NixOS/nixpkgs,SymbiFlow/nixpkgs,triton/triton,triton/triton,SymbiFlow/nixpkgs,SymbiFlow/nixpkgs,NixOS/nixpkgs,NixOS/nixpkgs,SymbiFlow/nixpkgs,SymbiFlow/nixpkgs