refactor: hoist OS-specific package names to role defaults

- nfs_server: nfs_package_name (nfs-utils / nfs-kernel-server)
- wireguard: wireguard_package_name (wireguard-tools / wireguard)
- tooling:   tooling_dig_package, tooling_netcat_package

Also fix tooling role structure: move tooling.yml to tasks/main.yml so
the role is actually invokable via 'role: tooling' (defaults/main.yml
is auto-loaded), and collapse the 10 individual package tasks into a
single list-based install.

roles/wireguard/defaults/main.yml

@@ -15,3 +15,7 @@ wireguard_config_base_path: /etc/wireguard
 #         endpoint: host:port           # optional: peer's public endpoint
 #         persistent_keepalive: 25      # optional: keepalive interval (seconds)
 wireguard_tunnels: []
+
+# OS-dependent package name
+wireguard_package_name: >-
+  {{ (ansible_facts['os_family'] == 'Archlinux') | ternary('wireguard-tools', 'wireguard') }}