Preserve state when disabling gomuks, use valid persistent VAPID keys,
require usable authentication credentials, and pin the container image.
Bring role variables, file permissions, documentation, changelog, and
SPDX attribution in line with project conventions.

Fix gomuks mount flag for older Docker:
   --mount type=bind ... rw is invalid on Docker < 23 (requires
   key=value). Other roles use bare dst=/data for rw (default) and ,ro
   for readonly. This fixes a systemctl failure: invalid field 'rw' must
   be a key=value pair.