Update common templates for Puppet 3
Add LDAP/PAM option for allowing local user logins

Because LDAP manages PAM (hhhnnnggg) this is where we have to configure
PAM. The only difference between ldap's default configuration and
optimus' is that local (/etc/passwd) users are allowed to login, so add
an option to enable that behaviour.