Implement pam_acct_mgmt and pam_chauthtok support.

This will ask for a new password if the user's password has expired
before unlocking.

As with XScreenSaver, checking for its return value needs to be
explicitly enabled via --enable-pam-check-account-type.