common-auth still carries nullok #13

Follow-up to #12.

/etc/pam.d/common-auth on a built core carries pam_unix.so nullok (Debian's default, from /usr/share/pam-configs/unix). #12 removes nullok from Webmin's own stack only.

On libpam 1.7 (Debian 13), measured with the real module in tests/pam-unix.bats: through a stack with nullok, an account whose field is empty or U6aMy0wojraho (the crypt of the empty string) is authenticated with any password, without being asked. #12 makes the build write *, which closes that for root, but any other account that ever carries an empty field is open through every service that includes common-auth (login, su, and so on).

Removing it is not a sed on common-auth: pam-auth-update regenerates that file from the profiles on every PAM package upgrade, so the change has to be a profile (or a diverted /usr/share/pam-configs/unix) that survives it, with a test that runs pam-auth-update and asks the real module afterwards.