fix(fail2ban): use ProtectSystem=full so ufw can create its lock file

strict makes /run read-only, which blocks ufw's /run/ufw.lock and
cannot be whitelisted via ReadWritePaths (the file does not exist).
full still protects /usr and /etc while leaving /run and /var writable,
so only /etc/ufw needs an explicit write path.

roles/fail2ban/templates/hardened.fail2ban.conf.j2

@@ -2,12 +2,8 @@
 PrivateDevices=yes
 PrivateTmp=yes
 ProtectHome=read-only
-ProtectSystem=strict
+ProtectSystem=full
 RuntimeDirectory=fail2ban
 RuntimeDirectoryMode=0750
-ReadWritePaths=-/var/lib/fail2ban
-ReadWritePaths=-/var/spool/postfix/maildrop
-ReadWritePaths=-/run/xtables.lock
 ReadWritePaths=-/etc/ufw
-ReadWritePaths=-/var/lib/ufw
 CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW