Installing the python cryptography bindings with ansible.builtin.pip is rejected by PEP 668 on distributions
which mark their python installation as externally managed. Fedora 38+, Ubuntu 23.04+ and RHEL 10 are
affected, so the role aborted on its very first task there.
The package names are resolved from vars/ via first_found, which keeps distribution specifics out of the
task file. vars/main.yaml provides python3-cryptography as a fallback for every family without a dedicated
file, Archlinux overrides it with python-cryptography.
Co-authored-by: Copilot <copilot@github.com>