pam-arch: Move pam_shells under pam_pkcs11 to support username auto-detect

According to PAM-PKCS11 User Manual, user can provide a empty username and it will set username by mapped smartcard. However, this currently does not work for gdm-smartcard, because pam_shells will fail first on empty username.

Because pam_shells do not check empty username before checking whether username exists, we can do nothing to workaround it for empty username, so just move it under pam_pkcs11 so it will check the auto-detected username.