PAM: Make PAM responder socket-activatable
    
    As part of the effort of making all responder socket-activatable, let's
    make PAM responder ready for this by providing its systemd's units.
    
    In case the administrators want to use PAM responder taking advantage
    of socket-activation they will need to enable sssd-pam.socket and after
    a restart of the sssd service, the PAM socket will be ready waiting for
    any activity in order to start the PAM responder. Also, the PAM
    responder must be removed from the services line on sssd.conf.
    
    The PAM responder service is binded to the SSSD service, which means
    that the responder will be restarted in case SSSD is restarted and
    shutdown in case SSSD is shutdown/crashes.
    
    PAM responder, differently from the others, is a special case as it has
    two sockets and its private sockets must be owned by root and must have
    a specifc permission (0600). It's not new, though, and it's following
    what has been already done in the project..
    
    Related:
    https://fedorahosted.org/sssd/ticket/2243
    
    Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
    Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>