ansible-vault: ensure that tmp file is safely removed if it was not edited