feat(cis): add selectable profile and per-rule hardening toggles

roles/global_defaults/defaults/main.yml

@@ -103,6 +103,9 @@ system_defaults:
   features:
     cis:
       enabled: false
+      profile: default # default|l1|l2 (default = current house behaviour)
+      rules: {} # per-rule overrides, e.g. {usb_lockdown: false}
+      params: {} # parameter overrides, e.g. {pwquality_minlen: 16}
     selinux:
       enabled: true
     firewall: