If pam ldap isn't enabled, then ensure it's absent

Since the nss ldap package recommends the pam ldap package, we
need to explicitly disable it.

Change-Id: I8c59c9fa85cf8d3431b8a579f30d87963592c59f
Merge "If pam ldap isn't enabled, then ensure it's absent" into production