test: verify the role with molecule

The role was not covered by any automated test, so regressions in the drop-in file handling only surfaced on real
hosts. The scenario starts one container per supported distribution family and covers all four conditional branches of
tasks/main.yaml: a user, a user acting as another user, a group and a group acting as another user.

Beside the created rules the verification asserts that a rule declared as absent is removed again, that the drop-in
directory is included exactly once and that visudo accepts the resulting configuration, because a rejected drop-in file
invalidates every rule of the directory.

Co-authored-by: Copilot <copilot@github.com>

molecule/default/prepare.yml

@@ -0,0 +1,59 @@
+---
+
+- name: Prepare
+  hosts: all
+  gather_facts: false
+  vars:
+    # The base images ship neither a python interpreter for ansible nor the package manager bindings the role relies on.
+    _bootstrap: |
+      set -eu
+      if command -v pacman > /dev/null; then
+        pacman --sync --refresh --noconfirm python shadow
+      elif command -v apt-get > /dev/null; then
+        apt-get update
+        apt-get install --yes passwd python3 python3-apt
+      else
+        dnf install --assumeyes python3 python3-libdnf5 shadow-utils
+      fi
+  tasks:
+  # The raw command is wrapped explicitly, because the bootstrap relies on shell builtins.
+  - name: Bootstrap the python interpreter and the package manager bindings
+    ansible.builtin.raw: "/bin/sh -c {{ _bootstrap | quote }}"
+    changed_when: true
+
+- name: Seed the objects the converge refers to
+  hosts: all
+  tasks:
+  - name: Create the groups the converge grants permissions to
+    ansible.builtin.group:
+      name: "{{ item }}"
+      state: present
+    loop:
+    - molecule-admins
+    - molecule-ops
+
+  - name: Create the users the converge grants permissions to
+    ansible.builtin.user:
+      name: "{{ item }}"
+      group: users
+      state: present
+    loop:
+    - molecule-alice
+    - molecule-bob
+
+  # The removal path of the role can only be observed on a drop-in file that exists before the role runs.
+  - name: Create the drop-in directory the seeded file lives in
+    ansible.builtin.file:
+      path: /etc/sudoers.d
+      state: directory
+      owner: root
+      group: root
+      mode: "0750"
+
+  - name: Seed the drop-in file that the converge removes again
+    ansible.builtin.copy:
+      content: "molecule-alice ALL=NOPASSWD: /usr/bin/true\n"
+      dest: /etc/sudoers.d/molecule-obsolete
+      owner: root
+      group: root
+      mode: "0440"