ansible: use sudo only for installing packages