(PUP-1587) crontab: make sure that invalid crontabs aren't written out

I have a fix, but am not completely satisfied.

I can keep the provider from including an invalid crontab entry in its output to crontab(1), no problem. I raise an exception in this case. Sadly, the output of that is very messy.

If I do not raise an error and just disregard the resource, the agent confusingly claims to have created the record, even though no action is taken.

I tried to find a middle ground by catching the exception in the ensure property and calling Puppet.err. This does yield more readable error output, but the spurious "created" message will be shown alongside the error message. Thoughts?