TESTS: Fix build with older version of check framework
Teach PAM client to do multi-pass

First cut at multi-pass in the PAM module.  We bump the version to 4 and
add a request item that contains both a context ID and a subcommand.

By default, that subcommand is "one-shot", indicating the traditional
behavior where the responder hands us a final reply.

When passed "multi_pass" as an argument, the module changes that
subcommand to "start".  So long as the reply comes back with status
INCOMPLETE and a substatus of to-be-continued (with a matching context
ID, of course), we parse out any AUTH_REQUEST items in the reply, select
a group of them to be attempted, collect answers for them, and submit
another request with the same context ID, a subcommand of "continue",
and their values as AUTH_ANSWERs.
Expand sss_authtok to handle secrets, OTPs, PINs
Display the type of PAM auth tokens when debugging
Rework item formats to meet lengths-first expectations
pam_sss: tag authtok items
pam responder: parse and pass along multistep info
Pass authtoks around; pass multi-step data to dp's
Flesh out debug messages
Handle all the prompts
Make it easier to add prompts
Add a password prompt type
Add the rest of the prompt types