pam: Disable pam_krb5, pam_ksu by default.

These are not useful unless you also set up /etc/krb5.conf and a
keytab for the host from the Kerberos KDC. But having them enabled
by default means that creating /etc/krb5.conf just to enable use of
Kerberos for _client-side_ single sign-on creates usability issues.

As proposed on tech-security:
https://mail-index.netbsd.org/tech-security/2023/06/16/msg001160.html

branches: 1.5.40; 1.5.50; 1.5.58;
add want_agent to the commented line of pam_ssh

Add pam_skey so that we get behaviour similar to "pre PAM".

branches: 1.3.20;
Add pam_afslog. Like pam_krb5, this is a fast, quiet no-op if you aren't
actually using it the subsystem.

Approved by: gendalia

Disable pam_ssh by default, and refer people to pam_ssh(8) for information
on its security risks.

Major cleanup of PAM service configuration files.

add want_agent to the commented line of pam_ssh

Add pam_skey so that we get behaviour similar to "pre PAM".

branches: 1.3.20;
Add pam_afslog. Like pam_krb5, this is a fast, quiet no-op if you aren't
actually using it the subsystem.

Approved by: gendalia

Disable pam_ssh by default, and refer people to pam_ssh(8) for information
on its security risks.

Major cleanup of PAM service configuration files.

Sync with HEAD.