Update keymaker-create-account-for-iam-user with options to force PAM stack termination

[kislyuk]

In #19 and #22, keymaker-create-account-for-iam-user was made not to terminate the PAM stack. Determine when it is unsafe to do so due to implicit assumptions made in how people typically configure SSH, whether we need an option to force PAM stack termination, and how it interacts with other common methods of authentication.