feat(cis): add selectable profile and per-rule hardening toggles

roles/cis/tasks/crypto.yml

@@ -2,12 +2,15 @@
 # Fedora ships its own crypto-policies preset and update-crypto-policies
 # behaves differently; applying DEFAULT:NO-SHA1 can break package signing.
 - name: Configure System Cryptography Policy
-  when: os in (os_family_rhel | difference(['fedora']))
+  when:
+    - cis_effective_rules.crypto_policy | default(false)
+    - os in (os_family_rhel | difference(['fedora']))
   ansible.builtin.command: "{{ chroot_command }} /usr/bin/update-crypto-policies --set DEFAULT:NO-SHA1"
   register: cis_crypto_policy_result
   changed_when: "'Setting system-wide crypto-policies to' in cis_crypto_policy_result.stdout"
 
 - name: Mask Systemd Services
+  when: cis_effective_rules.mask_services | default(false)
   ansible.builtin.command: >
     {{ chroot_command }} systemctl mask {{ 'nftables' if system_cfg.features.firewall.toolkit == 'iptables' else 'iptables' }} bluetooth rpcbind
   register: cis_mask_services_result