... and make the structs NMAuthSubject and NMAuthSubjectClass
opaque types.

I don't want to do this for all our types, only for a few prominent
GObject instances that we create a lot and that are really not expected
to ever be subclassed.

NMAuthSubject is such a candidate. It is really a very simple object
containing a few information bits about the authentication request.
It is not ever expected to be extended/inherited or become more
complex. No need to do a full-fledged private-data implementation.