test(molecule): cover the role with a molecule scenario

The role changed a lot and none of it was verified against a real system so far. The scenario starts one container per
supported distribution family, applies the role and asserts afterwards that the users and groups exist as declared,
that the managed files carry the documented mode, owner and content, that a user without optional settings does not
receive any of the optional files and that a user declared as absent is gone again.

The idempotence step is the actual reason for the scenario. The deterministic password salt and the btrfs device
lookup were changed to stop reporting a change on every run, and only a second converge proves that.

A btrfs home is not covered, because a container has no btrfs filesystem to create a subvolume on.

The ssh key pair the scenario feeds into the role is generated during create and removed again during destroy, so no
private key material ends up in the repository. The generated files are ignored for the case that a destroy never
runs.

Co-authored-by: Copilot <copilot@github.com>

molecule/default/prepare.yml

@@ -0,0 +1,37 @@
+---
+
+- name: Prepare
+  hosts: all
+  gather_facts: false
+  vars:
+    # The base images ship neither a python interpreter for ansible nor ssh-keygen, which the role shells out to.
+    _bootstrap: |
+      set -eu
+      if command -v pacman > /dev/null; then
+        pacman --sync --refresh --noconfirm openssh python shadow
+      elif command -v apt-get > /dev/null; then
+        apt-get update
+        apt-get install --yes openssh-client passwd python3
+      else
+        dnf install --assumeyes openssh-clients python3 shadow-utils
+      fi
+  tasks:
+  # The raw command is wrapped explicitly, because the bootstrap relies on shell builtins.
+  - name: Bootstrap the python interpreter and the tools required by the role
+    ansible.builtin.raw: "/bin/sh -c {{ _bootstrap | quote }}"
+    changed_when: true
+
+# The removal paths of the role can only be observed on objects that exist before the role runs.
+- name: Seed the objects the converge removes again
+  hosts: all
+  tasks:
+  - name: Create the group that the converge removes
+    ansible.builtin.group:
+      name: molecule-obsolete
+      state: present
+
+  - name: Create the user that the converge removes
+    ansible.builtin.user:
+      name: molecule-dave
+      group: users
+      state: present