configure /etc/login.defs to reduce SCAP tailoring file

We disable password auth, but setting defaults for password
in /etc/login.defs means we don't have to carry the exceptions
in the openscap tailoring file.