Shut down forked PAM handle

[Xyene]

Shutting down the forked PAM handle must be done as per the Linux-PAM documentation, specifically after setuid.

https://fossies.org/linux/Linux-PAM-docs/doc/adg/html/adg-interface-by-app-expected.html#adg-pam_end

This is not a new requirement, but until recently (~2021) there was no consequence to not doing so.

pam_cap now requires the handle to be shut down correctly in order to configure ambient capabilities for the session. Importantly, these must be configured after setuid, as setuid clears the ambient capability vector.

See this comment (and thread) for more details: https://github.com/shadow-maint/shadow/pull/408#issuecomment-919673098