feat(roles/aide): add role and playbook

[NavidSassan]

Adds a role and playbook for AIDE on RHEL 8, 9 and 10. Supersedes #227.

What is in here

aide role and playbook (feat commit)

• /etc/aide.conf is fully templated. The options and attribute groups follow the installed aide version: 0.16 on RHEL 8, 0.19 on RHEL 9 / 10. The two are not config-compatible (database vs database_in, verbose vs log_level, removed hashsums). The rules live in aide__rules__role_var and default to the list RHEL 9 / 10 ship. Items are keyed by path, so the inventory can override a default rule in place, remove it with state: 'absent', or add new ones (regular, equal, negative).
• aide-check.service (oneshot, low CPU / IO priority) runs aide --check from aide-check.timer. Any finding leaves the unit failed; there is no mail. The unit names and database paths are the ones system_update already expects for its re-baseline after updates.
• The database is created on the first run, after everything the role writes to monitored paths.
• When the role changes the config or its units, it re-baselines only if the last check was clean, the same guard system_update uses. Otherwise the database is left alone and the run says so at the end. --tags aide:update_db (never-tagged) accepts the current state and clears the failed unit.

system_update security lane (fix commit)

• The daily security lane on Rocky now handles AIDE like the weekly lane: it notes a failing check before the transaction (mailed only on days that install something, log kept at /var/log/aide/aide.log-pre-security-update) and re-baselines after a transaction that changed packages if the check was clean. Without this, every hot-fix made the next check fail. The AIDE code of both lanes is otherwise identical.

Points worth a close look

• /root/.ansible/tmp is excluded on top of the stock list. Without it, aide --init records the temporary directory of its own Ansible task, and every later check reports it as removed.
• Within one directory aide applies the first matching rule. Verified on 0.16 and 0.19. combine_lod keeps an overridden item in its original position, which is what makes overriding a default rule work.

Testing

• New Molecule scenario aide on rocky8/9/10: passes (converge, verify, idempotence, verify). verify.yml checks that:
  • a check on the converged host runs clean
  • a file below a rule from the inventory is reported
  • files below a negative rule and below a removed default rule (/opt) are not reported
  • the check is clean again after cleanup
• By hand on the same VMs:
  • a config change with a failing check leaves the database alone and prints the message
  • --tags aide:update_db recovers the host
  • adding and removing a rule re-baselines both times; without the re-baseline the same rule makes the check fail (rc 1)
• Security lane, by hand against real pending updates (baseos + appstream as the security repos): Rocky 9 / 10 re-baseline and the next check passes, while a check against the pre-update database fails (rc 7); Rocky 8 with a failing check leaves the database alone and keeps the log. The system_update scenario still passes on rocky8/9/10.
• Debian and Ubuntu are out of scope.