refactor(cis): extract hardcoded values to cis_defaults and add _normalize.yml

roles/cis/tasks/_normalize.yml

@@ -0,0 +1,4 @@
+---
+- name: Build cis_cfg from defaults and user overrides
+  ansible.builtin.set_fact:
+    cis_cfg: "{{ cis_defaults | combine(cis | default({}), recursive=true) }}"