Allow passing Ticketsalts for ticket generation

[mocdaniel]

In some environments, agents can't directly connect to the cluster's masters. In those situation, cluster onboarding (e.g. ticket generation) gets delegated to satellites. This is already possible, using icinga2_delegate_host.

However, for this to work, the satellite needs to have the TicketSalt of the master system(s) configured in order to calculate a valid ticket. This exposes the TicketSalt unnecessarily, as it gets persisted on the agent's file system.

Also, when provisioning for the first time, the passed TicketSalt hasn't been loaded into Icinga2's running state yet, and below command actually fails, leaving the instance in kind of a limbo.

However, it's possible to pass the TicketSalt to the CLI command being issued by Ansible in this situation:

icinga2 pki ticket --salt <salt_goes_here> --cn mocdaniel.example.com

Could we introduce another variable, e.g. delegated_ticket_salt, that allows us to only expose the TicketSalt during provisioning satellites/agents via Ansible?