Personal preference on how the ansible fact is structured.

Some VMs should not, and/or cannot have qemu-guest-agent. This commit
makes it so that the agent can be skipped by adding an ansible fact with
the value "false" on a given host.

This makes the `depot-ci.pep.security` host use its respective playbook
for nginx file serving.

This reverts commit 5175e40c.

This will prevent the jobs from running on a Runner without the proper
configuration.

also makes ansible-pull script a bit more robust

this prevents the task from deleting groups the user is already in