fix: resolve trust store location per distribution family

The trust store import hardcoded the RHEL anchor directory and
`update-ca-trust`, although `meta/main.yaml` also declares ArchLinux and Ubuntu
as supported platforms. On those distributions the task created a dangling
symlink outside any trust source and then failed on the missing binary.

Resolve both the anchor path and the update command from a map keyed by
`ansible_facts['os_family']`. Debian based systems additionally require the file
extension `crt`, because `update-ca-certificates` ignores anchors named
otherwise.

Note that the role now depends on gathered facts.

Co-authored-by: Copilot <copilot@github.com>

tasks/root_certificate_authority.yaml

@@ -66,19 +66,29 @@
           _stat_result.stat.exists
 
 - name: Import certificate of root Certificate Authority (CA) into systems trust store
+  vars:
+    # Debian based distributions only consider anchors with the file extension crt.
+    _trust_store_anchor:
+      Archlinux: "/etc/ca-certificates/trust-source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
+      Debian: "/usr/local/share/ca-certificates/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.crt"
+      RedHat: "/etc/pki/ca-trust/source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
+    _trust_store_update_command:
+      Archlinux: "/usr/bin/update-ca-trust"
+      Debian: "/usr/sbin/update-ca-certificates"
+      RedHat: "/usr/bin/update-ca-trust"
   when: certificate_authority_root_ca_import is defined and
         certificate_authority_root_ca_import
   block:
   - name: Create symolic link
     ansible.builtin.file:
       src: "{{ certificate_authority_root_ca_path }}/cert.pem"
-      dest: "/etc/pki/ca-trust/source/anchors/{{ certificate_authority_root_ca_common_name | replace(' ', '_') }}.pem"
+      dest: "{{ _trust_store_anchor[ansible_facts['os_family']] }}"
       owner: root
       group: root
       state: link
   - name: Update systems SSL/TLS trust store
     ansible.builtin.command:
-      cmd: /usr/bin/update-ca-trust
+      cmd: "{{ _trust_store_update_command[ansible_facts['os_family']] }}"
     register: _update_ca_trust
     changed_when: _update_ca_trust.rc == 0
     failed_when: _update_ca_trust.rc > 0