Preserve state when disabling gomuks, use valid persistent VAPID keys,
require usable authentication credentials, and pin the container image.
Bring role variables, file permissions, documentation, changelog, and
SPDX attribution in line with project conventions.

Fix gomuks mount flag for older Docker:
   --mount type=bind ... rw is invalid on Docker < 23 (requires
   key=value). Other roles use bare dst=/data for rw (default) and ,ro
   for readonly. This fixes a systemctl failure: invalid field 'rw' must
   be a key=value pair.

Add new role custom/matrix-client-gomuks for https://github.com/gomuks/gomuks
(web frontend with Go bouncer backend, image dock.mau.dev/gomuks/gomuks).

The client is disabled by default (matrix_client_gomuks_enabled: false)
so Element remains the default web client and the change is safe to
push upstream.

Configuration is derived from ~/.config/containers/systemd/gomuks.container
but adapted for the playbook: single /data bind mount (GOMUKS_ROOT=/data),
listens on 0.0.0.0:29325, Traefik labels, systemd service, and
generation of config.yaml from matrix_homeserver_generic_secret_key
(auth, token_key, VAPID keys, origin_patterns, logging).

Wiring: matrix_server_fqn_gomuks, group_vars, setup.yml,
matrix_playbook_public_client_urls, systemd manager; docs,
container-images and README updated.