This should ensure that passwords don't refer to old host names if they
are renamed, for example during discovery

libxcrypt 4.1 - and maybe others - have a stricter idea about which
characters salts are allowed to contain

Salts should now match `[./0-9A-Za-z]{1,16}`, which seems to be the most
widely supported character set

The lengthened cache is enough for two Puppet runs, halving the total
number of requests for the passwordstate server