Add PAM environment variable support to pam_escalate.so

These changes pass variables from pam_getenvlist in pam_escalate.so to pam-escalate-helper in the start message and do the reverse in the finish message. That will let us pass things like KRB5CCNAME in the user's environment to pam_krb5.so running inside pam-escalate-helper so the user's Kerberos creds are refreshed on screen unlock.