Function classify_pam_hook 

pub fn classify_pam_hook(path: &str) -> bool

Classify whether a PAM library path is suspicious.

Returns true when the path contains “pam” (case-insensitive) and does not start with a known system library directory.