Improve PAM authentication

[rosstimothy]

Today, PAM authentication modules are invoked in response to a shell request, and any resulting instructions or prompts are fed back to the user via stdin/stdout of the ssh.Session. This can causes a deadlock, see #49028, if PAM is trying to read/write via the ssh.Session prior to replying the the shell request. Instead PAM authentication should occur during the SSH handshake via the ssh.KeyboardInteractiveCallback similarly to how PAM works with OpenSSH. The main challenge with adding support for this out of the box lies in how the ssh_service handles user connections. Instead of reexec-ing multiple subprocesses to handle various SSH requests, Teleport should use a single process to handle user connections, allowing a single PAM context for the duration of each connection.