Title: #269: Add support for ActiveDirectory's logonHours restrictions
Changed field: body
This is a straightforward patch for denying access to a user when the user is not
permitted to access their account due to logonHours restrictions.
This matches the default behaviour for domain-joined Windows machines. When outside the
logonHours, all types of authentication are denied (password/Kerberos/certificate) - so it
is appropriate to put this check inside the PAM "account" rules.