oci: Install FreeBSD-pam in the runtime image

[ivy]

Summary

In 16.0/15.1, the PAM modules were split from FreeBSD-runtime into a
new FreeBSD-pam package. FreeBSD-runtime does not install FreeBSD-pam,
which means if a user starts from runtime, then installs sshd, sshd will
fail to authenticate users because of missing PAM modules.

Since FreeBSD-pam is relatively small (about 230kB on amd64), and is
already part of FreeBSD-set-minimal, add it to the runtime image as
well. Users who absolutely don't want this can still build their
own images without it.

MFC after: 1 week
Reported by: Michael Johnson <[e-mail]>
Sponsored by: The FreeBSD Foundation

[dfr]

This is probably fine, given the small size. I guess it could be a dependency of FreeBSD-ssh instead but adding it to FreeBSD-runtime covers both FreeBSD-ssh and e.g. openssh installed from ports.

[ivy]

In D59194#1357926, @dfr wrote:

I guess it could be a dependency of FreeBSD-ssh instead but adding it to FreeBSD-runtime covers both FreeBSD-ssh and e.g. openssh installed from ports.

we deliberately didn't make it a dependency of FreeBSD-ssh because in that case you'd always have it installed, even if you were only using the client or wanted UsePAM no.

that's less of an issue with the OCI images because you can just build your own images if you really need a smaller one, but you can't easily build modified base packages without forking src.