nixos/pam: make pam_loginuid optional if in container