Use a logic level (Vgs-threshold <= 2V would be good) MOSFET (N Channel for a low side power switch, it's the easiest).
The following diagram is something I put together to teach my robotics club how to do basic power circuitry, in this case to drive a 12V DC PC case fan. In your case, the fan motor is just a 5V motor, but still is essentially a fan/motor. The protection diode shown is still important.
In this case the "switch" is your 3.3V sensor output. The PIR sensor output may not be high for very long, you should perhaps use a 555 timer and some buffers/inverters to keep the signal to the MOSFET high for longer, with the RC constant as something reasonable for your application.
Depending how your 5V rail is supplied to the pump, you may want to put some bulk capacitance such as a few hundred microfarads, or even a few thousand, to prevent it from drawing the line low during current transients as the pump turns on. This same advice holds true for using servos, and many other motors. Always buffer the power supply with local bulk capacitance!
First of all, are those numbers for the pump all from the same model? Because the range of the numbers is rather large: you say that it starts with 2 watts, nominally runs at 15 watts(?), might sink 4.5 amps at 12 volts, which gives 54 watts. And even larger numbers are calculated in your question, which probably aren't relevant.
Looks to me that even the 120 watt panel is overkill, but it can be connected directly to that pump if the pump can inded handle 24 volts, which is more than the open circuit voltage, which is the maximum voltage the panel can ever generate.
The thing to realize here is that it's the amps that turn the motor, not the volts. Volts are something that have the capability of giving amps to a load. And pushing amps through a load generates volts across the load. In your case, there's a solar panel, which is more like a constant current source, unlike, say, a battery, which is more like a constant voltage source.
When you connect the solar to the motor and there is sun, the panel pushes amperes to the load. The 120W panel looks like it might push something like 6 amps to the motor. That would perhaps generate something like 16 volts over the motor, although this number is only based on a rough feeling. That would mean that some 96 watts are dissipated somewhere in the pump - and that seems quite a lot for a pump that nominally takes 15 watts. I don't know; maybe the pump is electronically regulated somehow so that it never draws so many amps...?
All in all, I have a bit uneasy feeling about this. It would help if you could provide some more info about the pump. A link to a datasheet or a product page, maybe?
Best Answer
The pump itself requires nothing when it is not running. The brushless controller may well draw significant current. There is not a "normal" or "typical" value here, it's whatever the designer chose. For example they may have saved a few pennies by using a regulator that draws 5 or 10mA with no load, which may seem perfectly reasonable if battery power is not being considered. 10mA at 12V for a month is equivalent to 5W for more than 17 hours.
Easiest thing is to measure it. But if it draws too much you can likely simply cut power to it when it is not being used, with a relay or a MOSFET.