refactor(vars): add system/hypervisor dict inputs

roles/cis/tasks/crypto.yml

@@ -1,12 +1,12 @@
 ---
 - name: Configure System Cryptography Policy
-  when: os in ["almalinux", "rhel9", "rhel10", "rocky"]
-  ansible.builtin.command: "{{ chroot_command }} /mnt /usr/bin/update-crypto-policies --set DEFAULT:NO-SHA1"
+  when: os == "rhel" or os in ["almalinux", "rocky"]
+  ansible.builtin.command: "{{ chroot_command }} /usr/bin/update-crypto-policies --set DEFAULT:NO-SHA1"
   register: cis_crypto_policy_result
   changed_when: "'Setting system-wide crypto-policies to' in cis_crypto_policy_result.stdout"
 
 - name: Mask Systemd Services
   ansible.builtin.command: >
-    {{ chroot_command }} /mnt systemctl mask nftables bluetooth rpcbind
+    {{ chroot_command }} systemctl mask {{ 'nftables' if firewall_toolkit == 'iptables' else 'iptables' }} bluetooth rpcbind
   register: cis_mask_services_result
   changed_when: cis_mask_services_result.rc == 0