Session hooking on OpenBSD

[netbsduser]

OpenBSD doesn't use PAM internally (not in login, doas, sudo, and importantly sshd) so the InitWare PAM module is of little use. It might be usable for e.g. the GDM port to OpenBSD (which I believe does use PAM) but not for general purpose use. It uses BSD Auth isnstead.

BSD Auth has an approval script option which we can use, but it can't set environment variables for an SSH login as SSHD runs it in a privilege-separated process after forking the unprivileged process.

For now, let's just implement the approval script and we'll deal with SSH later.