feat(security): add auditd/journald/logrotate role

Port Modules/Security/secharden-audit-agents.sh.

Deploys hardened configurations for:
- auditd (log rotation, disk space actions, email alerts)
- systemd-journald (persistent storage)
- logrotate (weekly rotation, 4 weeks retention)

This role is disabled by default (run_security_audit: false) matching
the legacy script which was commented out of the run order.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

roles/security_audit/tasks/main.yml

@@ -0,0 +1,31 @@
+---
+# Auditd / journald / logrotate — port of Modules/Security/secharden-audit-agents.sh.
+
+- name: Deploy /etc/audit/auditd.conf
+  ansible.builtin.copy:
+    src: auditd.conf
+    dest: /etc/audit/auditd.conf
+    owner: root
+    group: root
+    mode: "0640"
+    backup: true
+  notify: Restart auditd
+
+- name: Deploy /etc/systemd/journald.conf
+  ansible.builtin.copy:
+    src: journald.conf
+    dest: /etc/systemd/journald.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true
+  notify: Restart journald
+
+- name: Deploy /etc/logrotate.conf
+  ansible.builtin.copy:
+    src: logrotate.conf
+    dest: /etc/logrotate.conf
+    owner: root
+    group: root
+    mode: "0644"
+    backup: true