Move the authenticaion subsystem over to the same 'module:options' syntax

Move the authenticaion subsystem over to the same 'module:options' syntax
that the passdb code now uses.  Similarly, move the 'pluggable' stuff
over from passdb as well, allowing runtime loading of new authenticaion
modules.

(NOTE:  The interfaces here can *and do* change - module writers are
not assured source-level compatibilty, and certainly not binary
compatibility).
(This used to be commit 3897cf5e048f50be91ae434f636affc6d539d0d1)