PAM: add pam_response_filter option
    
    Currently the main use-case for this new option is to not set the
    KRB5CCNAME environment varible for services like 'sudo-i'.
    
    Resolves https://fedorahosted.org/sssd/ticket/2296
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
    (cherry picked from commit ce43f710c9638fbbeae077559cd7514370a10c0c)