Separate playbook/roles for hosts we have root/sudo on

Most hosts I deploy my dotfiles to are going to be one where I have root/sudo access, but this won't always be the case. It would be nice to gate some tasks behind a custom fact to do things like:

- Add my user to various groups
  - systemd-journal
  - wheel/sudo
  - audio
  - video
- Edit sudoers
  - Make sets of commands not require a password, e.g. package management
- Adjust firewall