At least inside Xephyr, xsecurelock otherwise does not respond to
display size changes when the composite overlay window is not used (it
normally is).

Simulates multi monitor setups, but is currently quite limited in
functionality (also, resizing screens does not appear to work
correctly).

Internal reference: b/73107658.

Allow for up to three attempts on every PAM call unless a conversation error occurred (i.e. cancelled by user or timeout).

Also remove the EXIT_ON_CONVERSATION_ERROR and instead detect PAM
modules calling converse() a second time after having received an error
and exit then. Allows us to exit "cleanly" after conversation errors.

Also despam logging by hiding any errors that have been retried or
caused by a conversation error.

This gives the user one minute to retry logging in while not using
noticeably more power. Works around some displays that take really long
to wake up from "off" state.

This reduces the chance of burn-in due to misbehaving saver children,
and also allows improving saver_blank in a separate change by sleeping
before blanking (so one can quicker retry to log in).

Now the 1 second sleep after displaying an alert can be interrupt by a
key press; however this does not affect sleep times inside PAM modules.

Rather just hardcode what control codes are, which restricts us to ASCII
superset encodings, but auth_pam_x11 already does that too.

XSECURELOCK_WANT_FIRST_KEYPRESS: no longer forward the first keypress if it is purely control characters.

Fixes "trying to unlock with the escape key only causes the screen to
quickly turn on and off again", as well as "immediate authentication
failure when trying to unlock with the enter key".

Internal reference: b/72708660.

Usage:

xsecurelock [...] -- command to run when locked.

Fixes #19.

This allows deferring the XMapWindow call to after grabs succeeded, so
in case grabbing fails the screen no longer turns temporarily black.
This reduces the danger that someone may think grabbing succeeded then
closes their laptop.

Also, rename grab_window to background_window now that there's no longer
a grab on it.

It was a security hole due to suspend interaction. Let's rather not do
that, and instead provide the same feature via xss-lock's -n option.

Salvage the xss-lock supporting parts to instead inhibit suspends until
the screen is actually blanked - this prevents some information leaks.

Instead, let's do all with environment variables. It's more consistent
that way.

We require xss-lock's -l option to prevent sleep while unauthenticated
wakeup is allowed.

For extra paranoia, we're trying to detect xss-lock being the parent
process, and if so - and if its -l option is not used - we disable
unauthenticated wakeup.

Additional paranoia: arm not just a MONOTONIC but also a REALTIME timer, and forbid unauthenticated wakeup when either expires.

This prevents unlocking when the computer was sleeping while the timer was running.

Now shows like:

```
             Password:

            **********_
Keyboard: English (US), Caps Lock
```

Fixes #11.

This serves to provide a quick way to prevent the screen lock from
starting when accidentally launched (e.g. while watching a video).

The amount of time is controlled by the environment variable
XSECURELOCK_ALLOW_UNAUTHENTICATED_WAKEUP_TIME_SEC and can be set in the
range from 0 (feature turned off) to 10 (maximum allowed value).

During this time, the screen saver does not run and an animation
indicating this process is drawn instead.

Requires -lrt and CLOCK_MONOTONIC.

Fixes #12.

auth_pam_x11: support font selection

Usage:

- Find a good font name with xfontsel.
- Launch the screen saver via something like:

```
XSECURELOCK_FONT=-misc-fixed-medium-r-normal--20-200-75-75-c-100-iso10646-1 xsecurelock 
```

If the font can for some reason not be loaded, we're still falling back to fixed to allow SOME unlocking.

Many other screen savers send the wake-up keypress to the auth dialog,
so let's offer this feature to. Do read the security notes about this in
the source, though.

Fixes #14.

We have no need of handling this, however we don't want to spam about
this event on stderr.