masks and disabled service, unapply is idempotent

[gonoph]

resolves #1 and #2

Need to run the systemd_service module twice:

1. to disable and stop the service
2. to disable, stop, and mask the service

Failing to mask the service last renders the service automatically enabled if it was enabled previously, and then manually unmasked.

Added service_facts module to ensure idempotency of playbook when mitigation is unapplied and then further configuration changes are performed on the host.