(pam) switch normal console to pam, because we lock accounts locally now, console login should be switched at the same time

(pam) work in progress: pam helper skip for non local users, for non existing users pam should proceed to the next option.

When our pam modules is used, we set local auth to disabled (locked) for our users, non local users should automatically use normal unix auth.
For this to work, we should pass PAM_USER_UNKNOWN as return value in our pam module when the user is not local to us and unauthenticated.

Early installer is really about an untained system, so
we defer *all* system setup and only keep the loopback
configuration above it.  This way, after config import
from the installer system_login_configure() is up-to-date.

(ipsec) add clone phase 2 option to ease duplication/modification, closes https://github.com/opnsense/core/issues/1305

PR: https://forum.opnsense.org/index.php?topic=4094

The installer user is injected for install media login, but
we authenticate against our database now instead.  This has
larger consequences that require a persistent installer user,
which is not so easy to disable/defang after installation.

Hopefully this is temporary.

(configd/templates) add "template cleanup" command, closes https://github.com/opnsense/core/issues/1238

(traffic shaper) add flush all and reload action, closes https://github.com/opnsense/core/issues/1297

Way better fix for the squid file transition.  Does not require
a manual restart anymore.