common: Implement Fedora specific OS hardening

[JGoutin]

Implement common Fedora relevant security hardening.

• [x] Grub password.
• [x] securetty.
• [x] /dev/random Entropy: Nothing to do.
• [x] Kernel sysctl
• [x] Kernel boot options
• [x] kernel modules
• [x] Disable devices like USB, ... when not required.
• [x] PAM, login, ...

Refs:

• https://static.open-scap.org/ssg-guides/ssg-fedora-guide-standard.html#!
• https://www.cisecurity.org/benchmark/fedora_family_linux
• https://www.cisecurity.org/benchmark/centos_linux
• https://www.cisecurity.org/benchmark/red_hat_linux
• https://www.cisecurity.org/benchmark/rocky_linux
• https://dev-sec.io/baselines/linux/
• https://github.com/dev-sec/ansible-collection-hardening/tree/master/roles/os_hardening
• https://github.com/konstruktoid/ansible-role-hardening
• https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_the_GRUB_2_Boot_Loader/#sec-GRUB_2_Password_Protection
• https://madaidans-insecurities.github.io/guides/linux-hardening.html
• https://obscurix.github.io/security/kernel-hardening.html
• https://wiki.archlinux.org/title/Random_number_generation
• https://wiki.archlinux.org/title/security
• https://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/
• https://github.com/Kicksecure/security-misc
• https://github.com/a13xp0p0v/kconfig-hardened-check/
• https://blog.privacyguides.org/2022/04/22/linux-system-hardening/
• https://git.sr.ht/~krathalan/systemd-sandboxing/tree

Also:

• https://www.cisecurity.org/benchmark/nginx
• https://www.cisecurity.org/benchmark/postgresql
• https://linuxfr.org/users/samuel/journaux/durcir-nginx-et-php-avec-systemd

Everything must be optional and revertible.

[JGoutin]

We now have a correct security baseline.

This can still be improved, and will be in future versions.