Create interactive prompt for use when fido device is not detected

[StephenBeynon]

Create new interactive prompt for use when fido device is not detected to remind the user to plug it in. While this does have the disadvantage of informing an attacker fido devices are in use some environments might consider this worth while to reduce confusion during the switch to fido authentication.

[LDVG]

Hi,

We generally try to avoid adding configuration options to keep complexity low. Is the interactive option too obtrusive?

As an aside: If we improve the module's return values, this could be implemented in the PAM stack instead by retrying with interactive set if no authenticators are found. (Related: #320)

[AlkalineJaunt]

This seems possible right now, by something like

auth       sufficient   pam_u2f.so
auth       [success=done new_authtok_reqd=ok ignore=ignore default=die] pam_u2f.so interactive

...with your appropriate defaults set.

Edit:- Meh... Maybe not. It gets ugly when you have the token plugged in, but mistype the PIN