Separate libpam-sys-helpers from libpam-sys. This separates the parts of libpam-sys that don't need linking against libpam from the parts that do need to link against libpam.

FROM docker.io/debian:stable

RUN apt-get -y update \
    && apt-get -y upgrade \
    && apt-get install -y cargo mercurial wget build-essential \
    && apt-get clean