fix(cis): add pipefail to sshd version detection and define binary defaults

roles/cis/tasks/sshd.yml

@@ -32,7 +32,9 @@
 
 - name: Detect target OpenSSH version
   ansible.builtin.shell: >-
-    {{ chroot_command }} ssh -V 2>&1 | grep -oP 'OpenSSH_\K[0-9]+\.[0-9]+'
+    set -o pipefail && {{ chroot_command }} ssh -V 2>&1 | grep -oP 'OpenSSH_\K[0-9]+\.[0-9]+'
+  args:
+    executable: /bin/bash
   register: cis_sshd_openssh_version
   changed_when: false
   failed_when: false