ansible: Add restricted rsync endpoint

[jbruechert]

NOTE: The ssh key is of course not final, and will be replaced by one that is available on github actions.

General idea:

• Only allow to start rrsync on the rsync account
• Use dash as login shell for the rsync user, since ssh will start the command in this shell. Bash is known to do much magic. rrsync recommends dash.
• Only allow writing to the target directory, not reading anything
• Sandbox rrsync to only be able to read basic system binaries and its target directory. Notably not /etc or anything that could contain private keys.

Fixes: #28