Ensure admin_user can connect before disabling root

[fullyint]

Resolves #294

Only merge after #344 which converts sshd_permit_root_login to boolean.

[swalkinshaw]

when: not sshd_permit_root_login and admin_user_status|failed

Think that's the same

[fullyint]

Nice. Thanks. I'll use that instead.

[fullyint]

I added a commit with adjustments to handle this scenario:

Imagine root login was disabled on a previous run of server.yml. Now someone removes sudo from their admin_user's groups and reprovisions. The "Setup users" task would remove the admin_user from the sudo group and now Ansible has no sudoers. To prevent that, we need to verify that sudo is in groups (and potentially fail) before running "Setup users".

However, the check for whether admin_user can connect to the server must be run later, after the "Add SSH keys" task.

So, our checks for sudo and general connectivity are necessarily separated within the users role.

Note that it might be more convenient to users if the sudo group check were performed sooner, perhaps in the common role, instead of unnecessarily waiting so far into the playbook to check and fail. Conceptually, however, the check fits in the users role, so that's where I left it.

[swalkinshaw]

@fullyint squash + CHANGELOG update?

Looks good 👍

[fullyint]

updated CHANGELOG and squashed