only run 'update-pam' when needed

TelekomLabs-DCO-1.1-Signed-off-by: Matthew Haughton <matt@3flex.com.au> (github: 3flex)