Fix Kerberos credential refreshes under pam_escalate.so and apps like gnome-screensaver.

Applications like gnome-screensaver don't set a PAM environment at all. It's usually OK because modules like pam_krb5.so fall back to getenv() when pam_getenv() returns nothing. Since pam_escalate.so wipes all environment variables when it starts (it's setuid-root so it's paranoid), the fallback to getenv() doesn't work.

With this change, a line like "auth ... pam_escalate.so add_env=KRB5CCNAME" would add KRB5CCNAME (Kerberos credential cache path) to the PAM environment sent to pam-escalate-helper if it wasn't already set.

I'd like a better way to do this, like another module similar to pam_env, but this action is probably only useful to pam_escalate.so because of the helper's unique behavior.