feat(cis): add selectable profile and per-rule hardening toggles

roles/global_defaults/tasks/_normalize_system.yml

@@ -142,6 +142,9 @@
       features:
         cis:
           enabled: "{{ system_raw.features.cis.enabled | bool }}"
+          profile: "{{ system_raw.features.cis.profile | default('default') | string }}"
+          rules: "{{ system_raw.features.cis.rules | default({}) }}"
+          params: "{{ system_raw.features.cis.params | default({}) }}"
         selinux:
           enabled: "{{ system_raw.features.selinux.enabled | bool }}"
         firewall: