Draft: wip role forgejo

Installation is now idempotent, but secrets need to be generated by hand beforehand

Additionally currently the instance is setup without an admin user which means a manual podman exec -it forgejo /bin/sh and then forgejo admin user create --username="" --email="" --random-password --must-change-password --admin=true is needed