(GH-216) Alter role call not idempotent with cleartext passwords

The postgresql::role defined type was not idempotent when passed cleartext
passwords. This is because we were comparing it with its md5 equivalent in
the db.

This patch converts any cleartext passwords to md5 before comparison, but
only if they are cleartext (ie. not starting with md5).

I also bumped the version of rspec-system-puppet to get use of the refresh
method, plus did some cleanup because the old tests were a bit dusty, again
taking advantage of refresh plus changing some matchers for clarity.

Signed-off-by: Ken Barber <ken@bob.sh>