desktop: use "staff only" background on eruption
desktop: split xfce from xsession, remove lxde
desktop: disable xscreensaver via site config

This sets the xscreensaver mode to blank in the site config file. It's a
little better than puppeting the entire user .xscreensaver file since we
can hopefully maintain better compatibility across versions.

(Ideally we'd use augeas instead of sed, but the config file format
looks crazy so I don't even want to attempt it)
common/auth: enable root password login

By default, jessie disables root login via SSH except via SSH keys.
It's actually important that we be able to SSH in to a server as root in
case Kerberos goes down [1], so we explicitely turn it back on.

In the future, maybe we should find a good way to use SSH keys (rather
than a shared root password) for the root user.

[1] Technically if LDAP goes down, we should still be able to log in due
to nscd, but it might take a long time. Kerberos is necessary for
password/GSSAPI auth, though.
desktop/grub: don't require password for normal boot
common/auth: add --force to pam-auth-update exec

This is mostly a problem when bringing up a new desktop; we need to
enable the "mkhomedir" PAM profile, and if we run `pam-auth-update`
manually, we get a nice menu prompt to enable it. But just running
`pam-auth-update --package` won't actually enable it, since it thinks
we've overriden it (or something). Adding --force fixes that.
desktop/xsession: add back penguin to lightdm

Unfortunately it's somewhat hacked-in because there's a bug in current
lightdm-gtk-greeter that prevents us from using the normal
default-user-image property to specify an image:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767576

This is already fixed upstream, but the new version wouldn't have time
to make it into jessie before the freeze even if it was submitted today.
So, for now, we just use this relatively hacky solution.
desktop: remove wheezy testing code