common/users: move the passwordless-sudo thing to the top, and add a validation check

Signed-off-by: Mattia Rizzolo <mattia@debian.org>

roles/common/tasks/users.yml

 ---
 
+- name: allow passwordless-sudo to use sudo
+  template:
+    src: users/sudoers-passwordless-sudo
+    dest: /etc/sudoers.d/passwordless-sudo
+    mode: 0440
+    validate: visudo -cf %s
+
 - name: create groups
   group:
     name: "{{ item.name }}"
@@ -52,8 +59,3 @@
   with_items: "{{ admin_users.keys() }}"
 
 
-- name: allow passwordless-sudo to use sudo
-  template:
-    src: users/sudoers-passwordless-sudo
-    dest: /etc/sudoers.d/passwordless-sudo
-    mode: 0440