Fix not_if guard on package installation

The current not_if guard will always fail if sudo is not installed. This
commit switches the guard to use "which sudo" instead.

You might be asking yourself, why? Why is this even here? Isn't Chef's
`package` resource idempotent? Of course it is. But this guard is required
for OSX support, since it would install the incorrect/invalid sudo package
and break the Internet.