r/doas: Configure sudo alternative

In the spirit of replacing bloated tools with unnecessary functionality
with smaller, more focused alternatives, we can use `doas` instead of
`sudo`.  Originally, it was a BSD tool, but the Linux port supports PAM,
so we can still use `pam_auth_ssh_agent` for ppasswordless
authentication.

users.yml

@@ -1,4 +1,8 @@
 - hosts: all
+  roles:
+  - role: doas
+    tags:
+    - doas
   tasks:
   - name: ensure users exist
     user: