fix(fail2ban): ban via ufw deny (DROP) instead of reject

REJECT needs the nft_reject kernel extension, which is unavailable on
this Arch kernel (iptables-nft reports 'Extension REJECT revision 0
not supported'), so every ban silently failed. DROP works everywhere
and is quieter toward attackers.

roles/fail2ban/templates/jail.local.j2

@@ -4,4 +4,5 @@ banaction  = {{fail2ban_firewall}}
 allowipv6  = true
 ignoreip   = 127.0.0.1/8
 backend    = {{fail2ban_backend}}
+blocktype  = {{fail2ban_blocktype}}
 ignoreself = true