Update config file only when there are changes.

This allows the sentinel to write to the config file without
puppet making changes unless it has bonafide config changes it would
like to do.

This is done by having a 'refreshonly' exec which subscribes to a
config file that sits alongside the config file that sentinel
actually uses.