Modify LKOUT003 to only trigger with action :create

In order to add some flexibility around controlling users created
outside of chef, we allow those to be specified without a uid/gid
if they use action :modify or :manage