ref(roles): All roles use desired package state

By setting the `desired_package_state` variable we can change if ansible
should only ensure that the packages exist on the system (`present`) or
that they are also updated to their latest version (`latest`).

roles/gnupg/tasks/main.yaml

@@ -3,13 +3,13 @@
     name:
       - gnupg
       - gnupg2-scdaemon
-    state: "{{ desired_package_state }}"
+    state: "{{ desired_package_state | default('present') }}"
   tags: packages
 
 - name: Ensure user group plugdev exist
   ansible.builtin.group:
     name: plugdev
-    state: present
+    state: "present"
 
 - name: Put user in plugdev group
   ansible.builtin.user: