tools: Fix pam_listfile PAM stage

This should be in "account" (aka. "denied access"), not "auth" (aka.
"provided wrong credentials"). Thanks to Stephen Gallagher for pointing
out!

tools/arch/cockpit.pam

@@ -1,7 +1,7 @@
 #%PAM-1.0
 auth      include   system-remote-login
 # List of users to deny access to Cockpit, by default root is included.
-auth       required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account   required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
 account   include   system-remote-login
 password  include   system-remote-login
 session   include   system-remote-login

tools/cockpit.debian.pam

@@ -3,7 +3,7 @@ auth       required     pam_sepermit.so
 auth       substack     common-auth
 auth       optional     pam_ssh_add.so
 # List of users to deny access to Cockpit, by default root is included.
-auth       required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account    required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
 account    required     pam_nologin.so
 account    include      common-account
 password   include      common-password

tools/cockpit.pam

@@ -4,7 +4,7 @@ auth       substack     password-auth
 auth       include      postlogin
 auth       optional     pam_ssh_add.so
 # List of users to deny access to Cockpit, by default root is included.
-auth       required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account    required     pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
 account    required     pam_nologin.so
 account    include      password-auth
 password   include      password-auth