GitLab

We've avoided doing this in the past because we didn't want to hardcode
a specific chain, but doing a lookup based on the issuer should be very
future-proof.

We were relying on manual validation by the operators, which has
generally worked out but is a bad idea. Mistakes would result in
an image build with broken certs, with no automated process that
would catch this before the image was deployed.

* validate the parseability of keys
* validate the parseability of certificates
* verify that the key matches the certificate
* verify the cert chain

Setting this in [ssh_connection] was accidentally broken, but it should
still work as a global setting.

Sometimes we end up with replicaA pointing to replicaB, which
caused `redis-remove replicaB` to bomb out waiting for it to not
have replicas.

warn is deprecated and now disabled by default, so we can stop setting
it.

For the other cases where we need to set additional options, these
modules now have a `cmd` option that lets us format these tasks the same
way as other modules instead of using the special `args` form.

Workaround for pip trying to uninstall requests, which now fails.

machine was too small for parallel build

* Move from flowerysong.sensu_go to sensu.sensu_go
* Move from hashi_vault lookup to flowerysong.hvault.kv
* Use custom AWS modules from flowerysong.melange, instead of using a
  forked Ansible.
* Enable jinja2_native.
* Remove manual generator unrolling.
* Remove custom ControlPath setting.
* Add some missing modes to file tasks (the provoking change was
  reverted, but it's better to be explicit regardless.)

* Use an HCL2 template
* Get rid of kludges required to make JSON templates work