feat: add ahfail-pam PAM module with cleanup-based failure detection

Implements a C-ABI PAM shared library that registers a pam_set_data
cleanup callback to detect auth failures and spawn/kill ahfail-display
via a double-fork, without ever touching credentials.

Cargo.lock

@@ -17,7 +17,6 @@ dependencies = [
  "gdk",
  "glib",
  "gstreamer",
- "gstreamer-player",
  "gtk",
  "libc",
  "pkg-config",
@@ -41,6 +40,9 @@ dependencies = [
 [[package]]
 name = "ahfail-pam"
 version = "0.1.0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "ahfail-ui"