doas: add enablePAM option

New option "withPAM" controls whether to build support for pluggable
authetincation modules. Default value is "true", which correspond to
existing behaviour. Futhermore, with default configuration, this change
do not cause rebuild.

pkgs/tools/security/doas/default.nix

@@ -4,6 +4,7 @@
 , bison
 , pam
 
+, withPAM ? true
 , withTimestamp ? true
 }:
 
@@ -23,6 +24,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     (lib.optionalString withTimestamp "--with-timestamp") # to allow the "persist" setting
+    (lib.optionalString (!withPAM) "--without-pam")
     "--pamdir=${placeholder "out"}/etc/pam.d"
   ];