feat(roles/redis, roles/valkey): listen on a Unix socket that the service group may use

[NavidSassan]

Extracted from #396, which builds on it: Nextcloud connects to Redis / Valkey through this socket.

Changes

• role:valkey, role:redis: listen on a Unix socket in addition to TCP. On RHEL the path is the one the package ships (/run/valkey/valkey.sock, /run/redis/redis.sock), on Debian and Ubuntu, whose packages ship the socket off, /run/valkey/valkey-server.sock and /run/redis/redis-server.sock. *__conf_unixsocketperm defaults to 770, so the members of the service group may connect; without it the mode follows the service's umask (0755) and only the daemon itself could. Redis has no unixsocketgroup (Valkey added it in 8.0), so access goes through the group on both. *__conf_unixsocket stays out of argument_specs, since its default comes from vars/<os>.yml, which is loaded after the role-entry validation.
• role:valkey, role:redis: keep the ownership of the config file that the package sets. The RHEL packages ship Z /etc/valkey ~0750 valkey root (and the same for Redis from Remi) in tmpfiles.d, which systemd-tmpfiles applies at every boot, so the root:valkey the role set flipped back and the next run reported a change. Debian and Ubuntu keep root:valkey.
• role:redis: meta/argument_specs.yml, derived from the valkey role, whose variables and static defaults are the same; checked with validate_argument_spec against every static default.
• molecule valkey: asserts that valkey answers on the socket, that the socket is open to its group only, and that the config file has the package's ownership and is not world-readable.

Tests

• As part of Nextcloud: hardening, Unix sockets for Redis/Valkey, and credentials out of reach #396, on Rocky 10 with Valkey: a second run of setup_nextcloud on a fresh host reports changed=0.
• Molecule valkey has not been run on this branch yet. Redis from Remi on RHEL 8/9 and the Debian family are untested (no change to that from Nextcloud: hardening, Unix sockets for Redis/Valkey, and credentials out of reach #396).

[NavidSassan]

Molecule valkey is green on Debian 13, Rocky 10 and Ubuntu 26.04 (converge, verify, idempotence, verify), ansible-core 2.16. The redis role has no scenario of its own; it is only exercised through setup_nextcloud on Rocky 8/9 in #396.