Use nslcd for LDAP authentication, RedHat support

- Instead of libpam-ldap and libnss-ldap (legacy code), set up the well
  supported nss-pam-ldapd instead (libpam-ldapd and libnss-ldapd.)
- Allow this to work on RedHat as well (tested on CentOS 6.4 and Amazon
  Linux 2013.9.)
- Instead of clobbering 4 pam.d files create one that only creates
  entries for LDAP instead of jeopardizing potential user modifications
  to those files. The files are evaluated as a whole directory, and
  order does not matter.
- Stop depending on nscd. Users can opt-in to nscd by including the
  recipe, preferably after this one has run.
- Support node[:openldap][:cafile] in more places.