roles/common: rework fail2ban tasks

We can only run fail2ban when we have logs to monitor. When a host
is running Caddy we don't have logs, so fail2ban doesn't have any-
thing to monitor out of the box. For now I will restrict the task
to hosts running nginx.

roles/common/tasks/fail2ban.yml

@@ -1,4 +1,15 @@
 ---
+- name: Install fail2ban
+  when:
+    - ansible_distribution_major_version is version('11', '>=')
+    - webserver is defined and webserver == 'nginx'
+  ansible.builtin.package:
+    name:
+      - fail2ban
+      - python3-systemd
+    state: present
+    cache_valid_time: 3600
+
 - name: Configure fail2ban sshd filter
   ansible.builtin.template:
     src: etc/fail2ban/jail.d/sshd.local.j2