SSH defaults to disallowing empty passwords but Dovecot has no similar
safeguard (at least not one enabled by default). Remove "nullok" from
/etc/pam.d/system-auth to implement the desired behavior system-wide.

Add "noqa no-changed-when" tags to handlers using the command module.
Perhaps it is wrong of ansible-lint to flag these, since handlers are
not the best place to have conditional execution.

Fixes: 26f289b7 ("Capitalize the first letter of all task names")

ansible-lint 6.5.0 complains about:

  name: All names should start with an
        uppercase letter. (name[casing])

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

Making 'kernel.yama.ptrace_scope' more strict by setting it to '2'
causes failures in elfutils' test suite. While tentatively helpful
on other servers, it seems kind of unnecessary for a build server.

Fixes: #424 (to be reopened though, if more restrictions are found)

- unprivileged bpf: we do not need this on our infra, we can assume
  bpf() calls will happen with CAP_SYS_ADMIN if required.

- unprivileged userns: we do not need this on our infra for none of
  our services or similar. Reduce attack surface by a huge margin
  including most recent CVE-2020-14386.

- kptr restrict: we already check for CAP_SYSLOG and real ids but we
  really do not require any specific kernel pointers to be logged.
  Settings this to 2 instead to blank out all kernel pointers to
  protect against info leak.

- kexec: disable kexec as we do never want to kexec our running servers
  into something else. Settings this sysctl disables kexec even if its
  compiled into the kernel.

- bpf jit harden: harden BPF JIT compiler to mitigate JIT spraying for
  the sacrifices off a bit performance for all users including
  privileged.

Since after enabling lockdown you cannot change the file anymore until reboot,
change the tmpfile setting to use ! and run only at boot time. This makes
systemd-tmpfiles --create command to not fail, since it cannot write to the lockdown
file.

Add sysctl hardening options which disallow perf/viewing kernel symbols
and dmesg for non-admin users as they contain valuable information for
attackers.