Use variable instead of group membership to install localhome

Use variable localhome to determines whether the localhome module is installed.
Default: localhome=false

Further changes:
- Move pam-exec from common-auth to common-session
- Move pam-mkhomedir before pam-mount to avoid double login on first use
  on localhome devices

roles/lmn_vm/tasks/main.yml

@@ -60,7 +60,7 @@
         ><not><or><user>root</user><user>ansible</user><user>Debian-gdm</user><user>sddm</user><user>{{ localuser }}</user></or></not>
       </volume>
     insertafter: "<!-- END ANSIBLE MANAGED BLOCK .* -->"
-  when: "'localhome' in group_names"
+  when: localhome is defined and localhome
 
 - name: Use umount script for proper cleanup
   blockinfile: