Multiple modules may want to set a session time limit (e.g., pam_time).  If
there is already a limit set and it's lower than the one we would set, leave
it alone.

pam_sm_close_session() is still a no-op

The time limit is meant to be cumulative for all sessions, and not allow
users to bypass the time limit after a session ends by starting a new session.
To handle this, implement support for reading the time used today from a
state file.

This implements reading the state file, but to write it we will need to
implement support for being a PAM session module as well.

This avoids segfaults when pamh.limit has never been initialized

We don't actually care about counting the number of pam_syslog() calls for
every single test, so drop some asserts.