Trying to figure out why tests are broken in CI

This should ensure that passwords don't refer to old host names if they
are renamed, for example during discovery

libxcrypt 4.1 - and maybe others - have a stricter idea about which
characters salts are allowed to contain

Salts should now match `[./0-9A-Za-z]{1,16}`, which seems to be the most
widely supported character set

The lengthened cache is enough for two Puppet runs, halving the total
number of requests for the passwordstate server