fix: install cryptography via the distribution package manager

Installing the python cryptography bindings with ansible.builtin.pip is rejected by PEP 668 on distributions
which mark their python installation as externally managed. Fedora 38+, Ubuntu 23.04+ and RHEL 10 are
affected, so the role aborted on its very first task there.

The package names are resolved from vars/ via first_found, which keeps distribution specifics out of the
task file. vars/main.yaml provides python3-cryptography as a fallback for every family without a dedicated
file, Archlinux overrides it with python-cryptography.

Co-authored-by: Copilot <copilot@github.com>

tasks/main.yaml

@@ -1,8 +1,21 @@
 ---
 
-- name: Install required python library cryptography
-  ansible.builtin.pip:
-    name: cryptography>=1.2.3
+- name: Include OS-specific variables
+  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
+  vars:
+    params:
+      files:
+      - "{{ ansible_facts['distribution'] }}_{{ ansible_facts['architecture'] }}.yaml"
+      - "{{ ansible_facts['distribution'] }}.yaml"
+      - "{{ ansible_facts['os_family'] }}_{{ ansible_facts['architecture'] }}.yaml"
+      - "{{ ansible_facts['os_family'] }}.yaml"
+      - main.yaml
+      paths:
+      - vars
+
+- name: Install required python libraries
+  ansible.builtin.package:
+    name: "{{ certificate_authority_python_packages }}"
     state: present
 
 - name: Create or import a root Certificate Authority (CA)

vars/Archlinux.yaml

@@ -0,0 +1,4 @@
+---
+
+certificate_authority_python_packages:
+- python-cryptography

vars/main.yaml

@@ -0,0 +1,6 @@
+---
+
+# Fallback for distributions without a dedicated vars file. Overridden by the
+# os-specific file included in tasks/main.yaml.
+certificate_authority_python_packages:
+- python3-cryptography