This mostly fixes `key-order` warnings around
`block` statements.

Reference: https://ansible-lint.readthedocs.io/en/latest/default_rules/#no-changed-when

Related to https://github.com/spantaleev/matrix-docker-ansible-deploy/pull/1939

Until now, we were leaving services "enabled"
(symlinks in /etc/systemd/system/multi-user.target.wants/).

We clean these up now. Broken symlinks may still exist in older
installations that enabled/disabled services. We're not taking care
to fix these up. It's just a cosmetic defect anyway.

When the playbook executes on a remote host (as it usually does),
we need to explicitly say `src` is a remote file and not relative
to the playbook.