Add pam_passwdqc module to %packages.

Not sure why, but pam_passwdqc is pulled
into normal installation media, but it is
not installed in live media environments
which was preventing logins in those
environments when remediation was run.
Append OS version to repo name.

A previous commit stopped appending a
version suffix to yum repo names.  The
new convention is to append the version in
CONFIG_REPOS manually.  Do that.
Policy fixups from live media testing.

Looks liek sudo pokes everything in /dev for some reason,
so don't audit those that seem unnecessary.

Other minor fixups.