Fix ansible-lint CI: add vault password and changed_when

Add ANSIBLE_VAULT_PASSWORD_FILE env var to the GitHub Action so
ansible-lint can parse vault-encrypted secret.yaml.

Add missing changed_when: true to two tasks in
get_openshift_release_binaries.yml that modify state (extract pull
secret, extract OCP tools) to fix no-changed-when violations.

Ref: OSPRH-32049
Change-Id: Id34425370a73e003b0fa1160105713ed8691c6cd
Signed-off-by: Itay Matza <imatza@redhat.com>

Author: imatza-rh

.github/workflows/ansible-lint.yml

@@ -21,3 +21,5 @@ jobs:
 
       - name: Run ansible-lint
         run: ansible-lint --strict
+        env:
+          ANSIBLE_VAULT_PASSWORD_FILE: /home/cloud-admin/.vault-pass

collection/tools/roles/tools_get_openshift_release/tasks/get_openshift_release_binaries.yml

@@ -27,6 +27,7 @@
       when: openshift_release_pull_spec is not defined or openshift_release_pull_spec == ''
 
     - name: Extract pull secret from host cluster via Kubernetes API
+      changed_when: true
       ansible.builtin.shell: |
         python3 << 'PYEOF'
         import yaml, json, base64, subprocess, os, sys, tempfile
@@ -127,6 +128,7 @@
         mode: u=rwx,g=rw,o=r
 
     - name: Extract OCP tools from release image {{ openshift_release_pull_spec }}
+      changed_when: true
       ansible.builtin.command:
         cmd: >-
           timeout 900