nixos/pam: allow disabling entirely

In containers, it can be reasonable to have no interactive logins at all 
and to run the container entirely 'lights out'. In this setting, PAM is 
dead weight, and adds considerably to container image size (mostly by 
bringing other things in to the closure). However, presently, there's no 
way to get rid of it.

This change adds the coarse tool of entirely disabling PAM. There 
_could_ be a warning or even an assertion, but I reasoned that there 
might be odd cases where it's desired - and not having PAM is not 
something that entirely disables the system, so a hard assertion feels 
wrong, and there are plenty of other ways to misconfigure a system if 
you go looking for trouble. I am also trying not to get sucked in to the 
morass of reforming pam.nix more broadly to make it less cumbersome, 
hence the coarsity of the setting.

nixos/modules/security/pam.nix

@@ -1854,6 +1854,17 @@ in
 
   options = {
 
+    security.pam.enable = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+
+      description = ''
+        Whether to enable PAM, or entirely disable it.
+
+        Unless you're building a container image, you probably don't want to disable PAM.
+      '';
+    };
+
     security.pam.package = lib.mkPackageOption pkgs "pam" { };
 
     security.pam.loginLimits = lib.mkOption {
@@ -2475,7 +2486,7 @@ in
 
   ###### implementation
 
-  config = {
+  config = lib.mkIf config.security.pam.enable {
     assertions = [
       {
         assertion = config.users.motd == "" || config.users.motdFile == null;