Initial Ansible setup

This doesn't do a whole lot just at the moment:
 * set up sshd with keys
 * set up sudo and sudoers
 * install Python (required for ansible)
..and only does so on the service hosts.

I've played with other necessary bits a little (jails, bootstrapping Ansible, handling secrets, etc.), but I want to start very small so that we can review each increment carefully.

Things various of you may not like:
 * using 'sudo' instead of 'su': this eliminates the need for anyone to know or type any passwords
 * use of `group_vars/all` for things like admin users
 * hardcoded hosts might make staging/development hard

Anyway, I'd like to commit this and then run it against the service hosts.  @verm?  @seankelly?  @sa2ajj?

Here's the output of a -C run (using -S which requires typing a shared password every time - blech)
```
(sandbox)dustin@ramanujan ~/code/buildbot/t/infra [init-ansible*] $ ansible-playbook -f 5 -C -S site.yml --ask-su-pass
su password: 

PLAY [servicehosts] *********************************************************** 

GATHERING FACTS *************************************************************** 
ok: [service2.buildbot.net]
ok: [service1.buildbot.net]
ok: [service3.buildbot.net]

TASK: [base | install python] ************************************************* 
changed: [service1.buildbot.net]
changed: [service3.buildbot.net]
changed: [service2.buildbot.net]

TASK: [base | install sudo] *************************************************** 
ok: [service1.buildbot.net]
ok: [service3.buildbot.net]
ok: [service2.buildbot.net]

TASK: [base | configure sudo] ************************************************* 
changed: [service3.buildbot.net]
changed: [service1.buildbot.net]
changed: [service2.buildbot.net]

TASK: [base | add/remove administrative users] ******************************** 
ok: [service3.buildbot.net] => (item={'username': 'john', 'state': 'absent'})
ok: [service1.buildbot.net] => (item={'username': 'john', 'state': 'absent'})
ok: [service2.buildbot.net] => (item={'username': 'john', 'state': 'absent'})
ok: [service3.buildbot.net] => (item={'username': 'jim', 'state': 'absent'})
ok: [service1.buildbot.net] => (item={'username': 'jim', 'state': 'absent'})
ok: [service2.buildbot.net] => (item={'username': 'jim', 'state': 'absent'})
ok: [service3.buildbot.net] => (item={'username': 'dustin', 'state': 'present'})
ok: [service1.buildbot.net] => (item={'username': 'dustin', 'state': 'present'})
ok: [service2.buildbot.net] => (item={'username': 'dustin', 'state': 'present'})
ok: [service3.buildbot.net] => (item={'username': 'amar', 'state': 'present'})
ok: [service1.buildbot.net] => (item={'username': 'amar', 'state': 'present'})
ok: [service2.buildbot.net] => (item={'username': 'amar', 'state': 'present'})
changed: [service3.buildbot.net] => (item={'username': 'mss', 'state': 'present'})
changed: [service1.buildbot.net] => (item={'username': 'mss', 'state': 'present'})
changed: [service2.buildbot.net] => (item={'username': 'mss', 'state': 'present'})

TASK: [base | add administrative users' SSH keys] ***************************** 
changed: [service3.buildbot.net] => (item={'username': 'dustin', 'state': 'present'})
changed: [service1.buildbot.net] => (item={'username': 'dustin', 'state': 'present'})
changed: [service2.buildbot.net] => (item={'username': 'dustin', 'state': 'present'})
ok: [service3.buildbot.net] => (item={'username': 'amar', 'state': 'present'})
ok: [service1.buildbot.net] => (item={'username': 'amar', 'state': 'present'})
ok: [service2.buildbot.net] => (item={'username': 'amar', 'state': 'present'})
failed: [service3.buildbot.net] => (item={'username': 'mss', 'state': 'present'}) => {"failed": true, "item": {"state": "present", "username": "mss"}}
msg: Failed to lookup user mss: 'getpwnam(): name not found: mss'
failed: [service1.buildbot.net] => (item={'username': 'mss', 'state': 'present'}) => {"failed": true, "item": {"state": "present", "username": "mss"}}
msg: Failed to lookup user mss: 'getpwnam(): name not found: mss'
ok: [service2.buildbot.net] => (item={'username': 'mss', 'state': 'present'})

TASK: [ssh | sshd configuration] ********************************************** 
changed: [service2.buildbot.net]

TASK: [ssh | enable sshd] ***************************************************** 
ok: [service2.buildbot.net]

NOTIFIED: [ssh | restart sshd] ************************************************ 
changed: [service2.buildbot.net]

PLAY RECAP ******************************************************************** 
           to retry, use: --limit @/home/dustin/site.retry

service1.buildbot.net      : ok=5    changed=3    unreachable=0    failed=1   
service2.buildbot.net      : ok=9    changed=6    unreachable=0    failed=0   
service3.buildbot.net      : ok=5    changed=3    unreachable=0    failed=1   

(sandbox)dustin@ramanujan ~/code/buildbot/t/infra [init-ansible*] $
```
What I mean is: do we really need `python` to be available?  Or we could stick to `python2`?