nixos/pam: add rule for pam_umask (#464322)

nixos/modules/security/pam.nix

@@ -583,6 +583,13 @@ let
           '';
         };
 
+        enableUMask = lib.mkOption {
+          default = config.security.pam.enableUMask;
+          defaultText = lib.literalExpression "config.security.pam.enableUMask";
+          type = lib.types.bool;
+          description = "If enabled, the pam_umask module will be loaded.";
+        };
+
         failDelay = {
           enable = lib.mkOption {
             type = lib.types.bool;
@@ -1292,6 +1299,12 @@ let
                   disable = cfg.ttyAudit.disablePattern;
                 };
               }
+              {
+                name = "umask";
+                enable = cfg.enableUMask;
+                control = "optional";
+                modulePath = "${package}/lib/security/pam_umask.so";
+              }
               {
                 name = "systemd_home";
                 enable = config.services.homed.enable;
@@ -2208,6 +2221,8 @@ in
       };
     };
 
+    security.pam.enableUMask = lib.mkEnableOption "umask PAM module";
+
     security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)";
     security.pam.enableFscrypt = lib.mkEnableOption ''
       fscrypt, to automatically unlock directories with the user's login password.