Leave debian /etc/pam.d/su unmodified until user attributes are set

While I think the code is really fine as it is, we'd prefer the ability to drop in the cookbook on all our nodes and only have it update servers where the users attribute is configured.

This pull request just gates the two resources in the default recipe behind a "unless ulimit['users'] == Mash.new" check. Would be open to other ways of doing this if you're interested in merging it (as it is, might cause an issue for debian/ubuntu users that want to use the domain lwrp without setting any ulimit['users'] attributes?)