feat: support precomputed bootloader password hashes

[richm]

Feature: Add bootloader_password_hash for configuring a precomputed
GRUB PBKDF2 SHA512 password hash.

Reason: The existing plaintext password interface generates a new hash
on every run, preventing idempotent password configuration.

Result: Users can manage bootloader passwords idempotently with
validated hashes while retaining secure logging and check-mode support.
Conflicting password settings are rejected. Add documentation and tests
using Ansible Vault for hash fixtures.

Signed-off-by: Rich Megginson rmeggins@redhat.com

Assisted-by: ChatGPT using model Astra Light 6

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: linux-system-roles/bootloader/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 1f6e7060-7ee2-4487-a868-27bce26590ff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI tests do not run automatically on pull requests. A role repository
maintainer can start them by posting a /citest slash command in a
pull request comment.

See GitHub CI testing using /citest
for details.

Run every available CI workflow:

/citest all

Run the linting and other lightweight checks:

/citest linters

Run the integration tests (QEMU/container and Testing Farm):

/citest integration

Run one or more selected workflows by separating their names with spaces:

/citest ansible-lint
/citest ansible-lint markdownlint

Command	Check name	Description
/citest all	All checks listed below	Run every CI test available for this role
/citest linters	Lint and lightweight checks	Run ansible-lint, ansible-test, ansible-managed-var-comment, codespell, markdownlint, pr-title-lint, test_converting_readme, and codeql, python-unit-test, and shellcheck when those workflows exist
/citest integration	QEMU/container and Testing Farm checks	Run qemu-kvm-integration-tests and tft
/citest ansible-lint	Ansible Lint / ansible_lint (<ansible-lint>, <ansible>, <python>) (pull_request)	Lint Ansible content after converting the role to collection format
/citest ansible-managed-var-comment	Check for ansible_managed variable use in comments / ansible_managed_var_comment (pull_request)	Fail if ansible_managed is used in comments
/citest ansible-test	Ansible Test / ansible_test (<ansible>, <python>) (pull_request)	Run ansible-test sanity tests
/citest codespell	Codespell / Check for spelling errors (pull_request)	Check for spelling errors
/citest markdownlint	Markdown Lint / markdownlint (pull_request)	Lint Markdown files
/citest pr-title-lint	PR Title Lint / commit-checks	Check that the pull request title follows the required format
/citest qemu-kvm-integration-tests	Test / scenario (<image>, <env>) (pull_request)	Run role integration tests in QEMU VMs and containers
/citest test_converting_readme	Test converting README.md to README.html / test_converting_readme (pull_request)	Convert README.md to HTML
/citest tft	<platform>|ansible-<version>	Run integration tests in Testing Farm
/citest woke	Woke / Detect non-inclusive language (pull_request)	Detect non-inclusive language
/citest codeql	CodeQL / Analyze (python) (pull_request)	CodeQL security and quality analysis for Python
/citest python-unit-test	Python Unit Tests / python (<python>, <os>) (pull_request)	Run Python unit tests

Post another /citest comment at any time to run another selection.

[richm]

/citest all