Use variable instead of group membership to install localhome

Use variable localhome to determines whether the localhome module is installed.
Default: localhome=false

Further changes:
- Move pam-exec from common-auth to common-session
- Move pam-mkhomedir before pam-mount to avoid double login on first use
  on localhome devices

roles/lmn_exam/tasks/main.yml

@@ -45,21 +45,21 @@
   ansible.builtin.copy:
     src: "{{ item }}"
     dest: /usr/local/sbin/
-    mode: 0755
+    mode: '0755'
   loop:
     - pam-exec.sh
     - rmexam
 
 - name: Enable login script via pam_exec.so
   ansible.builtin.lineinfile:
-    dest: /etc/pam.d/common-auth
-    line: "auth    optional        pam_exec.so /usr/local/sbin/pam-exec.sh"
+    dest: /etc/pam.d/common-session
+    line: 'session optional        pam_exec.so /usr/local/sbin/pam-exec.sh'
 
 - name: Provide rmexam services and timers for some scripts
   ansible.builtin.copy:
     src: "{{ item }}"
     dest: "/etc/systemd/system/{{ item }}"
-    mode: 0644
+    mode: '0644'
   loop:
     - rmexam.service
     - rmexam.timer