Restrict ansible-playbook's --limit option on specific operations

[PaulFarault]

Which issue(s) this PR fixes

Alternative to #679 and #682

Additional comments

• Introduce playbook metadata.
  Metadata for a playbook can now be defined in any play, using the vars.tdp_lib dictionary. When multiple plays provide metadata, the lib will merges them.

  Example:

  - name: task 1
    vars:
      tdp_lib:
        meta1: false
  
  - name: task 2
  
  - name: task 3
    vars:
      tdp_lib:
        meta2: foo

  Resulting metadata:

  meta1: false
  meta2: foo
  

  Overriding rules will be defined on a per-metadata basis.

  For now, only the can_limit metadata is supported. It defaults to true.
  Setting can_limit: false indicates that the play must run on all hosts (i.e., cannot be restricted using ansible-playbook --limit). This is required for certain global operations (e.g. Kerberos initialization).
  Specifying can_limit: false on any play applies to the entire playbook. If another play within the same playbook explicitly sets can_limit: true, a warning will be logged.

• Refactored playbook reading and validation.
  Playbook parsing and validation have been moved from InventoryReader to a new playbook_validate module. This make validation reusable (notably for the metadata extraction). The validation logic now relies on Pydantic rather than manual checks.

• Clearer deployment error messages.
  When running an operation with --limit, error messages are now more explicit. They distinguish between:

  1. operations that can't be executed (noop);
  2. operations not applicable to the targeted hosts;
  3. operations that cannot be limited.

  This will make it easier to introduce differentiated handling for these cases later.

Agreements

• I hereby declare this contribution to be licensed under the Apache License Version 2.0, January 2004.
• I hereby agree to grant TOSIT a copyright license to use my contributions.

[PaulFarault]

I wonder if we should continue execution and only display a warning if an host limit is provided for a noop. wdyt @rpignolet?

[PaulFarault]

As discussed, I pushed this PR further. It now allows to verify if an operation can be limited on specific host or not before running (and applying the --limit parameter).

I still have to think about the shape of the read_playbooks implementation.

[PaulFarault]

The PR has been completed.

Note that the current implementation only prevent from using the --limit option when a can_limit meta is defined for a playbook. It does NOT prevent the CLI to generate deployment plan with a limit on can_limit: false. This need to be fixed in another PR.