Ship a new pam file, this is the same except it's pam_oath-less

cockpit-no-pamoath.pam

@@ -0,0 +1,10 @@
+#%PAM-1.0
+auth substack common-auth
+# List of users to deny access to Cockpit, by default root is included.
+auth    required pam_listfile.so item=user sense=deny file=/etc/cockpit/disallowed-users onerr=succeed
+account required pam_nologin.so
+account include common-account
+password include common-password
+session required pam_loginuid.so
+session optional pam_keyinit.so force revoke
+session include common-session

cockpit.spec

@@ -55,6 +55,7 @@ Source0:        cockpit-%{version}.tar.gz
 Source1:        cockpit.pam
 Source2:        cockpit-rpmlintrc
 Source3:        cockpit-suse-theme.tar
+Source4:        cockpit-no-pamoath.pam
 Source10:       update_version.sh
 Source99:       README.packaging
 Source98:       package-lock.json
@@ -238,6 +239,8 @@ BuildRequires:  python3-tox-current-env
 
 %if 0%{?suse_version} > 1500
 cp %SOURCE1 tools/cockpit.pam
+%else
+cp %SOURCE4 tools/cockpit.pam
 %endif
 #
 local-npm-registry %{_sourcedir} install --include=dev --ignore-scripts