feat(security): add SCAP/STIG baseline hardening role
Port Modules/Security/secharden-scap-stig.sh.
Applies baseline STIG controls:
- GRUB config permission hardening (root:root, mode 0400), skipped on Pi
- Disable and purge autofs service
- Blacklist unused filesystem/kernel modules (usb-storage, dccp, rds,
sctp, tipc, cramfs, freevxfs, hfs, hfsplus, jffs2, squashfs, udf)
- Deploy login banners (/etc/issue, /etc/issue.net, /etc/motd)
- Harden cron permissions (cron.allow 0600, cron.deny removed)
- Harden at permissions (at.allow 0600, at.deny removed)
This role is the seed for the full DISA STIG/CMMC compliance library.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
mrcharles
fa41137eb4