pam: do not accept empty PIN
    
    The current check for an empty PIN was incomplete and if no PIN was
    given pam_sss should not send a request to SSSD's pam responder. This
    would match the behavior if a user name hint should be requested as
    well.
    
    Related to: https://pagure.io/SSSD/sssd/issue/4068
    
    Reviewed-by: Pavel Březina <pbrezina@redhat.com>