fix(fail2ban): ban via ufw deny (DROP) instead of reject

REJECT needs the nft_reject kernel extension, which is unavailable on
this Arch kernel (iptables-nft reports 'Extension REJECT revision 0
not supported'), so every ban silently failed. DROP works everywhere
and is quieter toward attackers.

roles/fail2ban/defaults/main.yml

@@ -1,3 +1,4 @@
 ---
 fail2ban_firewall: ufw
 fail2ban_backend: systemd
+fail2ban_blocktype: deny