Add new module "pam_escalate.so" for non-root applications

For issue #7, I'm adding a new module "pam_escalate.so" that proxies authentication requests to another PAM stack in a setuid-root helper called pam-escalate-helper. Along with proxying the authentication conversation, it does some scrubbing and security checks to make sure that the caller only tries to do auth for their own user unless the caller is root.

A typical workflow would be:

1. An application running as a normal user, like gnome-screensaver, calls pam_start and pam_authenticate.
2. PAM loads pam_escalate.so and calls pam_sm_authenticate.
3. pam_escalate.so launches the subprocess pam-escalate-helper and sends a start message to its stdin.
4. Helper calls pam_start with some args from the start message and its own conversation function.
6. For each call to the helper's conversation module by other PAM modules like pam_krb5, it sends the message over stdout and receives a response from pam_escalate.so on stdin.
7. When pam_authenticate() finishes, the helper sends a finish message with the return code and exits.
8. pam_escalate.so receives the finish message and returns the code to the user.

I'm not done yet, but here's an implementation that actually works. I still need to add more comments, more unit-tests, and probably better security checks. I should have it mostly finished tomorrow, but I figured I'd send the first parts early.

At some point I'll break it out into another project, but I'm just trying to get this done quickly for now.
My point was that expected_str includes 2 instead of ESCALATE_MESSAGE_TYPE_<foo>. It's easier to get the numbers wrong than the name of the define (and it's easier to spot errors in the latter case). My proposal is to pass the type in addition to expected_str and either ignore the type from the parsed message or double-check it against the expected value as well. I.e. something like:

    static void AssertMessage(GIOChannel *channel, const gchar *expected_str,
                              int expected_type) {
        // ...
        expected = EscalateMessageLoad(expected_str, &error);
        g_assert_cmpint(expected_type, ==, expected->type);
        // ...
        g_assert_cmpint(expected_type, ==, message->type);
        // ...