cron: Implement full PAM session lifecycle for user jobs

[delphij]

Summary

Extend PAM integration beyond account checks to include credential
establishment and session management, allowing PAM modules to configure
the execution environment for user cron jobs.

Previously, cron only called pam_acct_mgmt() to verify account validity
but immediately terminated the PAM handle before job execution. This
prevented PAM modules from establishing sessions, setting credentials
(e.g., Kerberos tickets), or exporting environment variables needed by
jobs.

The PAM handle now persists in the intermediate process throughout the
job execution, enabling proper session open/close pairing. Credentials
are established and sessions opened while still running as root, before
dropping privileges in the grandchild. PAM environment variables are
exported in the job process with user crontab variables taking precedence.

A session rule (pam_permit.so) is added to /etc/pam.d/cron to enable
session support without changing default behavior. Administrators can
replace this with other modules as needed.

System crontab entries continue to bypass all PAM operations.

MFC after: 2 weeks

Test Plan

Test with pam_deny.so as session provider: system crontab continues to work and user crontab fails.
Test with pam_xdg.so as session provider: env shall show XDG_RUNTIME_DIR set, while not showing it before.
Test with pam_lastlog.so: pam_open_session and pam_close_session were called.