Add a suid root helper for pam_unix

[zirias]

Summary

pam_unix needs to read the system's password database for
authentication. This requires the calling process to run with root
privileges.

Software authenticating with PAM therefore often uses own suid-root
helpers doing the whole authentication conversation privileged.

A helper for pam_unix can simplify this and reduce the code that must
run privileged, at least for the most common use case of authenticating
as self (needed for example by screen lockers). This helper drops
privileges directly after obtaining the password hash from the database.

Test Plan

As user_a, with both user_a and user_b being normal, unprivileged users:

$ echo <user_a_password> | /usr/libexec/pam_unix-helper user_a && echo ok should print ok
$ echo <random_password> | /usr/libexec/pam_unix-helper user_a && echo ok should print nothing
$ echo <user_b_password> | /usr/libexec/pam_unix-helper user_b && echo ok should print nothing

[zirias]

Only authenticate as self

Thanks to Darius on IRC for pointing out this helper could be abused for
automated password guessing.

I changed it now to only allow verifying your *own* password. Although
this doesn't cover all use cases any more, authenticating as self is
probably the most common one (needed for example by screen lockers), so
I think it's still useful.

[des]

No.

[cy]

Agreed. No.

[zirias]

Abandoned in favor of new port security/unix-selfauth-helper doing the same thing with pam_exec.