Supersedes https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4284

Fixes https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4297

Supersedes https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4300

This works around an issue with Matrix Authentication Service's `syn2mas` sub-command (at version v0.16.0),
which chokes with an error:

> Error: Failed to load Synapse configuration
> Caused by:
> invalid type: found unit, expected struct EnableableSection for key "default.cas_config" in homeserver.yaml YAML file

This issue is likely to be fixed in MAS v0.16.1 or v0.17.0.

refers to commit
  e65d19884 Run Element Web in tightened/read-only mode without a custom nginx config

and issue
  https://github.com/spantaleev/matrix-docker-ansible-deploy/issues/4199

This probably got fixed with Matrix Authentication Service 0.15.0 though
I'm not sure exactly which commit did it.

Ref: https://github.com/element-hq/matrix-authentication-service/releases/tag/v0.15.0

This is a backward-incompatible change. By default, Ansible creates
users with (e.g.) `/bin/sh` on Linux, so changing to a no shell
leads to different behavior.

That said, it appears that using a shell-less user works OK with regard
to Ansible execution and starting the systemd services/containers later on.

We create the `matrix` user as a system user (smaller uid), so it makes
sense to do the same for the `matrix` group.

This defaults to `true`, as before.

* migration ownership fix

* lint fix

* lint fixes

This should allow roles for other forks (like Tuwunel) to use similar tags.

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/4267