feat: retry downloads and package installs, make monitoring_plugins and icinga2_agent idempotent, fix the Rocky security lane

[markuslf]

Stacked on #413 (base fix/delegated-tasks-become), so this PR only shows its own six commits.

Changes

• roles: downloads from the network are retried up to three times, 10 s apart: get_url, git clones, rpm_key with a URL and the GitHub release lookups (83 tasks). Since ansible-core 2.16 retries without until repeats a task until it succeeds. Calls that change something are not retried. CONTRIBUTING describes the rule.
• role:monitoring_plugins: the legacy dependency list is compared by content, so an unchanged host reports no change; on Linux the role no longer stops and starts icinga2 around every deployment (a Windows workaround for locked files).
• role:icinga2_agent: icinga2 node setup, the ticket request and the agent restart run only if the agent certificate is missing, expired or not signed by the master's CA (icinga2 pki verify), the master presents a different certificate, or the setup parameters changed (hash in /var/lib/icinga2/linuxfabrik-node-setup.sha256, delete it to force a new setup). The Director's 422 "Trying to recreate" for a known host counts as success.
• roles: package installations are retried as well: every package, apt, dnf and pip task that installs or updates (160 tasks), not removals.
• role:system_update: the security lane installs exactly the latest versions the security repository has updates for, resolved with all enabled repositories. A hot-fix that needs a newer package from BaseOS or AppStream no longer fails: on Rocky 8.3 the kernel hot-fix requires a newer linux-firmware, and --enablerepo=security alone failed on every run.
• role:system_update: on Fedora 42 and later /usr/local/sbin is a symlink to bin, so removing the pre-FHS /usr/local/bin/update-and-reboot deleted the script just deployed. That removal is skipped there.

Tests

• retries without until: verified with ansible-core 2.16 and 2.18.
• Three consecutive setup_basic runs on fresh Rocky 9, Debian 13 and Fedora 44 clones (ansible-core 2.18, agent against a lab Icinga master): all failed=0; the second run skips the node setup and no longer restarts icinga2; the third run reports no changes except the controller-side git clones, which only change in the lab because of a git insteadOf redirect to local checkouts (verified: against GitHub the clone reports no change).
• Fedora 44: update-and-reboot is present after the run.
• Package retries: setup_basic on a fresh Rocky 9 clone failed=0; the EPEL key download hit a 404 once and passed on the retry.
• Security lane on fresh Rocky 8.3, 9.4 and 10.0 clones, started by hand: the kernel hot-fix comes from @security everywhere, linux-firmware from @baseos on 8.3; the reboot is requested via the spool.
• icinga2 pki verify exit codes checked against lib/cli/pkiverifycommand.cpp.
• ansible-lint: two findings fewer, no new ones. pre-commit green.