Prevents the following lint failure:

  jinja: You need to install "jmespath" prior to
         running json_query filter (jinja[invalid])

Removing just the list of vaulted var files triggers a schema violation.

We make almost no use of the dynamic properties of the hcloud inventory,
so we can simplify this by declaring all cloud servers in the main hosts
inventory.

The main benefit of this change is that temporary and experimental cloud
servers are not automatically included in the Ansible playbooks. In such
cases it is usually incorrect to deploy changes to these unknown servers.

A smaller side benefit is that Ansible will now use hostnames to connect
to cloud servers, whereas the dynamic inventory provided IPv4 addresses.
This results in more meaningful ~/.ssh/known_hosts entries.

The idea bebind this is to be able to give vault access to new DevOps
members without giving away more important credentials like Hetzner's.

Add diffutils needed for "terraform fmt --check --diff".

ansible-lint no longer depends on ansible[1][2] which causes it to fail
with: syntax-check: couldn't resolve module/action 'pacman', as the
modules is part of ansible and not ansible-base.

[1] https://bugs.archlinux.org/task/69920
[2] https://github.com/archlinux/svntogit-community/commit/a3ccb42b8dc104a4616a64fac4a1f6dd44ffedca

yaml: truthy value should be one of [false, true] (truthy)
yaml: wrong indentation: expected 4 but found 2 (indentation)
yaml: too few spaces before comment (comments)
yaml: missing starting space in comment (comments)
yaml: too many blank lines (1 > 0) (empty-lines)
yaml: too many spaces after colon (colons)
yaml: comment not indented like content (comments-indentation)
yaml: no new line character at the end of file (new-line-at-end-of-file)
load-failure: Failed to load or parse file
parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.

With a dynamic inventory and vault_password_file set it will try to use
them, which of course doesn't work in the CI.

https://github.com/ansible-community/ansible-lint/issues/953

Added --diff to the terraform fmt --check command, because it then will show the
offending lines on the pipeline output.