setup_basic: four tasks are not idempotent on the Red Hat family

[NavidSassan]

Describe the bug

A second run of setup_basic against an already converged Red Hat host reports four changes, so the Molecule idempotence step of the setup_basic scenario fails:

• monitoring_plugins : dnf versionlock delete linuxfabrik-monitoring-plugins*
• monitoring_plugins : dnf versionlock add linuxfabrik-monitoring-plugins*
• firewall : systemctl start fwb.service
• dnf_makecache : systemctl disable dnf-makecache.service

Seen identically on Rocky 8, 9 and 10 (LFOPS_TEST_TARGETS='rocky*' molecule test --scenario-name setup_basic).

What is known so far:

• The two monitoring_plugins tasks in roles/monitoring_plugins/tasks/linux-package.yml are plain ansible.builtin.command tasks without changed_when, so they report a change on every run by construction. CONTRIBUTING asks for changed_when, creates or removes on every command task. The right condition needs to be derived from the actual output of dnf versionlock add / delete (and of yum versionlock on RHEL 8).
• The firewall and dnf_makecache tasks use ansible.builtin.service, which is idempotent by itself, so the requested state apparently does not hold on the host between runs (for example a unit that exits right after starting, or a unit without an [Install] section). Not investigated yet.

The scenario never reached the idempotence step until #352, because converge always stopped earlier on its Debian-family targets in the network role, which COMPATIBILITY.md marks as not running on Debian. That is why these four went unnoticed.

Expected behaviour

A second run against a converged host reports no changes, and the setup_basic scenario passes on the Red Hat family.