(volt, macro usage) revert macro change, it looks like this really was a bug in PHP7/Phalcon, looks solved now. closes https://github.com/opnsense/core/issues/1245

(pam) switch normal console to pam, because we lock accounts locally now, console login should be switched at the same time

(pam) work in progress: pam helper skip for non local users, for non existing users pam should proceed to the next option.

When our pam modules is used, we set local auth to disabled (locked) for our users, non local users should automatically use normal unix auth.
For this to work, we should pass PAM_USER_UNKNOWN as return value in our pam module when the user is not local to us and unauthenticated.

Early installer is really about an untained system, so
we defer *all* system setup and only keep the loopback
configuration above it.  This way, after config import
from the installer system_login_configure() is up-to-date.

(ipsec) add clone phase 2 option to ease duplication/modification, closes https://github.com/opnsense/core/issues/1305

PR: https://forum.opnsense.org/index.php?topic=4094

The installer user is injected for install media login, but
we authenticate against our database now instead.  This has
larger consequences that require a persistent installer user,
which is not so easy to disable/defang after installation.

Hopefully this is temporary.