Join the new session keyring when the server starts rather than once the
configuration file has been loaded, and control it at build time with
--enable-keyring, on by default if linux/keyctl.h is found.
Rename keyring_join and keyring_revoke to new_session_keyring and
revoke_session_keyring.
The server otherwise keeps the session keyring of the login session that
started it, which pam_keyinit(8) may revoke when that session ends,
leaving the server and its panes unable to use the kernel keyring. Join
a new session keyring with the user keyring linked in once the
configuration file has been loaded, and revoke it when the server exits.
This is controlled by a new session-keyring server option, on by
default.
