plugin_auth_pam: change default sync/async operation

[cron2]

As of today, the auth-pam plugin defaults to sync operation, which has known drawbacks ("freeze the whole process"). To enable async/deferred mode, setenv deferred_auth_pam yes must be used.

We should change from opt-in to opt-out, and make the default async. This has been out in the field for a long time and has had time to really shake down any leftover bugs.

Brought up by @R9295 - give credits when changing.