feat(bootstrap): accept extra_addresses on network interfaces

roles/global_defaults/tasks/validation.yml

@@ -467,6 +467,21 @@
   loop_control:
     label: "{{ item | to_json }}"
 
+# A string here would iterate into one address per character in every network renderer.
+- name: Validate network interfaces extra_addresses
+  when: item.extra_addresses is defined
+  ansible.builtin.assert:
+    that:
+      - item.extra_addresses is not string
+      - item.extra_addresses is iterable
+      - item.ip | default('') | string | length > 0
+      - item.extra_addresses | reject('match', '^(\\d{1,3}\\.){3}\\d{1,3}/\\d{1,2}$') | list | length == 0
+    fail_msg: "system.network.interfaces[].extra_addresses must be a list of IPv4 CIDRs (192.0.2.10/24) on an entry that also sets 'ip'."
+    quiet: true
+  loop: "{{ system_cfg.network.interfaces | default([]) }}"
+  loop_control:
+    label: "{{ item | to_json }}"
+
 - name: Validate hostname format
   ansible.builtin.assert:
     that: