Configuration check must occur after restarting csf
Use "command" module instead of shell

So that error codes can be inspected, e.g.
Fix all invalid configuration values
Add csf configuration check to security_checks role