Add PAM environment variable support to pam_escalate.so

These changes pass variables from pam_getenvlist in pam_escalate.so to pam-escalate-helper in the start message and do the reverse in the finish message. That will let us pass things like KRB5CCNAME in the user's environment to pam_krb5.so running inside pam-escalate-helper so the user's Kerberos creds are refreshed on screen unlock.
Using 'result' or 'status' instead of 'success' sounds better to me. 'return success' sounds like we always return 'true'.