User Resource Limits: Per-User and Per-Group Caps with pam_limits

Two resource problems on this host, both fixed with user resource limits:

1. The inventory API runs as the user appsvc and opens a lot of sockets. Every appsvc session must start with an open-files limit of 4096 and be able to raise it to 8192, but no further.

2. A contractor's runaway script forked until the box fell over. Members of the group contractors must be capped at 50 processes, a ceiling they can't raise. User kim is in that group; user lee is not and must keep the defaults.

Configure this the persistent way, so it applies to every new login session (files under /etc/security/, read by pam_limits when a session opens). Don't change anyone else's limits. Grading opens a fresh login session as appsvc, kim and lee and reads ulimit in each one, so what counts is what a real login gets.