Make libpam-krb5 installation optional

Only install `libpam-krb5` if `node['kerberos']['pam']` is set to `true`.

Replaces the `pam-auth-update` calls in the default recipe.