fixed hostnames in the securedrop-prod playbook
added skipping tags for the production playbooks to ensure that the admin can test their tor connectivity first.

added the roles to the correct hosts per environment playbooks (securedrop-prod and securedrop-staging)
On first install this will most likely trigger a reboot.
Ansible will wait for the host to come back up after running unattended-upgrades.

moved the unattended-upgrades and apply grsec lock to the a separate role.
This is the last role ran on both servers. It will:
 - run unattended-upgrades
 - reboot if necessary
 - check to see if the grsec lock is present
 - if it not present the machine will reboot
 - if grsec lock option is present ensure it is applied

The grsec kernel is installed in the common role.