fix #5371: user management: document the PAM service of the PAM realm

Since pve-access-control commit 01f191c ("fix #1670: change PAM service
name to project specific name"), the PAM realm authenticates with the
PAM service name 'proxmox-ve-auth'. This allows changing the PAM
configuration for logins to Proxmox VE only, for example to not allow
logins of users with an empty password, which the default 'nullok'
option of pam_unix in common-auth does. But this is only mentioned in
the commit message.

Document the service name, the fallback to the 'other' service if no
such configuration exists, and that this configuration is local to each
node, like the system users.

Signed-off-by: Michal Fox <me@dualfroz.com>

pveum.adoc

@@ -184,6 +184,14 @@ endpoint only apply to the local node and not cluster-wide. Even though {pve}
 has a multi-master design, using different passwords for different nodes can
 still offer a security benefit.
 
+{pve} uses the PAM service name `proxmox-ve-auth` to authenticate users of this
+realm. This allows changing the PAM configuration only for logins to {pve},
+without affecting other services like the login on the console or via SSH, by
+creating the file `/etc/pam.d/proxmox-ve-auth`. If this file does not exist,
+PAM uses the configuration of the `other` service, so a copy of
+`/etc/pam.d/other` is a good starting point. Like the system users, this
+configuration is local to each node.
+
 In terms of configurability, an administrator can choose to require two-factor
 authentication with logins from the realm and to set the realm as the default
 authentication realm.