Linting for Ansible roles

[noahl]

#414 exposed an underlying weakness of our development platform, which is that we have no way of linting Ansible role files, and no way of testing them other than allocating VMs and running. This was particularly important in the second fix in that issue - the bug was extra }s, which should have been caught by any level of linter.

I'm filing this issue so we don't forget about the linting problem.