Goodies

* add nginx role (separate it from GH-25 as it can be used for other services)
* copy `getent` extras module (used by GH-25, but it can be used elsewhere)
* add a special worker account -- an account for non-privileged services/tasks
* fix the `local.yml` file (add secret loading and fix the first task's name)
Since this is supplied by whatever uses this role, I think it should be documented that `nginx_template` must be defined there.