test: verify the role with molecule

The role was not covered by any automated test, so regressions in the drop-in file handling only surfaced on real
hosts. The scenario starts one container per supported distribution family and covers all four conditional branches of
tasks/main.yaml: a user, a user acting as another user, a group and a group acting as another user.

Beside the created rules the verification asserts that a rule declared as absent is removed again, that the drop-in
directory is included exactly once and that visudo accepts the resulting configuration, because a rejected drop-in file
invalidates every rule of the directory.

Co-authored-by: Copilot <copilot@github.com>

molecule/default/converge.yml

@@ -0,0 +1,33 @@
+---
+
+- name: Converge
+  hosts: all
+  vars:
+    sudo_users_sudoers:
+    # A user without runas, restricted to a single command.
+    - user: molecule-alice
+      commands:
+      - /usr/bin/systemctl restart nginx
+      nopassword: true
+    # A user that acts as another user and stores its rule under a custom filename.
+    - user: molecule-bob
+      runas: molecule-alice
+      filename: molecule-bob-as-alice
+      nopassword: true
+    # A group that has to authenticate itself.
+    - group: molecule-ops
+      commands:
+      - /usr/bin/id
+      nopassword: false
+    # A group that acts as root.
+    - group: molecule-admins
+      runas: root
+      filename: molecule-admins-as-root
+      nopassword: true
+    - user: molecule-obsolete
+      state: absent
+  tasks:
+  # The role is included by the name of its directory, which molecule put on the roles path.
+  - name: Include the role sudo
+    ansible.builtin.include_role:
+      name: sudo