only run 'update-pam' when needed

There's no need to run `pam-auth-update` on every puppet run - only run it when one of the files that affects the command is added, updated or removed.