pam: fix loop in Smartcard authentication
If 'try_cert_auth' or 'require_cert_auth' options are used and a wrong
PIN is entered the PAM responder might end in an endless loop. This
patch uses a flag to avoid the loop and makes sure that during
authentication the error code causing the loop is not returned.
Related to https://pagure.io/SSSD/sssd/issue/4051
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>