feat: give higher priority to pam_sss module

With default priority (128), pam-auth-update put module pam_sss after
module pam_unix in /etc/pam.d/common-auth, and then a user with a
local account and local password synchronized with AD password will
never be granted a Kerberos TGT on session opening.

usr/share/pam-configs/yourdev

@@ -0,0 +1,23 @@
+Name: Yourdev authentication (SSSD)
+Default: no
+Priority: 512
+Conflicts: sss
+
+Auth-Type: Primary
+Auth:
+	[success=end default=ignore]	pam_sss.so use_first_pass
+Auth-Initial:
+	[success=end default=ignore]	pam_sss.so forward_pass
+Account-Type: Additional
+Account:
+	sufficient			pam_localuser.so
+	[default=bad success=ok user_unknown=ignore]	pam_sss.so
+Session-Type: Additional
+Session-Interactive-Only: yes
+Session:
+	optional			pam_sss.so
+Password-Type: Primary
+Password:
+	sufficient			pam_sss.so use_authtok
+Password-Initial:
+	sufficient			pam_sss.so