refactor: hoist OS-specific package names to role defaults

- nfs_server: nfs_package_name (nfs-utils / nfs-kernel-server)
- wireguard: wireguard_package_name (wireguard-tools / wireguard)
- tooling:   tooling_dig_package, tooling_netcat_package

Also fix tooling role structure: move tooling.yml to tasks/main.yml so
the role is actually invokable via 'role: tooling' (defaults/main.yml
is auto-loaded), and collapse the 10 individual package tasks into a
single list-based install.

roles/tooling/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+# OS-dependent package names
+tooling_dig_package: >-
+  {{ (ansible_facts['os_family'] == 'Archlinux') | ternary('bind', 'dnsutils') }}
+tooling_netcat_package: >-
+  {{ (ansible_facts['os_family'] == 'Archlinux') | ternary('openbsd-netcat', 'netcat-openbsd') }}