feat(roles/graylog_sidecar): add the Graylog Sidecar roles

[NavidSassan]

Adds two roles for the Graylog Sidecar log collector agent, plus their playbooks
and a Molecule scenario.

Why two roles

The Sidecar is served from its own package repository, versioned independently of
the Graylog server, so repo_graylog_sidecar is separate from repo_graylog.
Custom mirror and basic auth follow the other repo_* roles: credentials are only
written when a mirror URL is set.

What the role does not do

Collector backends and the assignment of collector configurations stay in the
Graylog web UI, matched to the host via graylog_sidecar__tags. What a host ships
is decided on the server, not in this role's variables.

Notes for review

• The package ships no systemd unit. The unit is generated by
  graylog-sidecar -service install, which upstream has been asked to do at package
  install time since 2018 (Service unit file should be automatically installed Graylog2/collector-sidecar#225, still open). The call is
  not idempotent (a second run exits 1 with "Init already exists"), hence the
  creates guard. It also enables the unit as a side effect.
• collector_binaries_accesslist is now explicit. The sidecar executes collector
  binaries as root, chosen by the server, and an empty list disables the check
  entirely (backends/backend.go). The default mirrors the sidecar's own Linux
  platform default, so behaviour is unchanged; the point is that the list is visible
  and can be narrowed.
• sidecar.yml is deployed 0600. It contains the API token, and the package
  itself ships the file 0600.
• CONTRIBUTING.md gains a paragraph on templating a fully-commented upstream config
  so that an *.rpmnew stays short and reviewable. sidecar.yml.j2 is the reference.

Testing

molecule test --scenario-name graylog_sidecar against a Rocky 10 VM: converge,
verify and idempotence all pass. The scenario asserts the package, the generated
systemd unit, the config file mode, the service state, and that the running sidecar
contacts the configured server_url (from the journal).

RHEL 8 and 9 are marked (x) in COMPATIBILITY.md, untested so far.