Remove duplicate paxctl headers logic from ansible

[msheiny]

Feature request

Description

We already have some paxctl header flagging in the grsec securedrop package as part of the postinst scripts. Lets scope that to make sure we arent duplicating ourselves here. This also seems like a task super related to grsecurity packaging and that logic should remain with the debian package.

User Stories

As a debian package, I don't want ansible to take my job.

[msheiny]

Additional note from security audit:

Not DRY: Vm.heap_stack_gap also enforced in grsec metapackage (this is a default var in grsecurity role in grsec_sysctl_flags)

[conorsch]

This is done! At least for Focal support. As of #5691, we now use paxctld for managing pax flags under Focal. For Xenial, there are still paxctl calls, but we'll clean that up after the EOL window.

As for the sysctl point, see #2725.