[ansible] Split out tasks that need sudo