(#20442) Filter attributes to only those managed

Prior to this commit, when trying to manage `attributes` for AIX users,
2 behaviours were occuring: 1) unmanaged attributes were included in the
"diff" and 2) regardless of current state, the changes were always
applied. This commit filters the changeset to only those `attributes`
explicitly mentioned in the manifest (or all of them in the case of
`puppet resource user`. Because the changeset is now sane, a change is
only enforced when necessary.