Add $resetpw parameter

Without this commit the resource to ensure domain machine passwords is
in sync always runs. There may be some situations where this is
undesireable. For example, if a machine is restored from a snapshop to
recover data, and a new machine has taken its place. In that case we
would not want to accidentally ruin the new machines trust relationship.

This commit adds a $resetpw parameter to toggle resetting the machine
password. It accepts `true` and `false`, but defaults to `true`,