Add new module "pam_escalate.so" for non-root applications

For issue #7, I'm adding a new module "pam_escalate.so" that proxies authentication requests to another PAM stack in a setuid-root helper called pam-escalate-helper. Along with proxying the authentication conversation, it does some scrubbing and security checks to make sure that the caller only tries to do auth for their own user unless the caller is root.

A typical workflow would be:

1. An application running as a normal user, like gnome-screensaver, calls pam_start and pam_authenticate.
2. PAM loads pam_escalate.so and calls pam_sm_authenticate.
3. pam_escalate.so launches the subprocess pam-escalate-helper and sends a start message to its stdin.
4. Helper calls pam_start with some args from the start message and its own conversation function.
6. For each call to the helper's conversation module by other PAM modules like pam_krb5, it sends the message over stdout and receives a response from pam_escalate.so on stdin.
7. When pam_authenticate() finishes, the helper sends a finish message with the return code and exits.
8. pam_escalate.so receives the finish message and returns the code to the user.

I'm not done yet, but here's an implementation that actually works. I still need to add more comments, more unit-tests, and probably better security checks. I should have it mostly finished tomorrow, but I figured I'd send the first parts early.

At some point I'll break it out into another project, but I'm just trying to get this done quickly for now.
Using ESCALATE_SERVICE_NAME seems fine for now but a more generic solution should make that configurable imho. The escalator will basically act on behalf of some other PAM module and it should be possible to still use different configs for different modules using the escalator. Maybe add a TODO note?