[Spike] Consume Noah-enabled splunk-ansible through the normal image build

[vivekr-splunk]

Review stack

Order	Repository	Change	Status
1	splunk-ansible	splunk/splunk-ansible#925: explicit Noah mode and role-specific provisioning	Review first
2	docker-splunk	This PR: pin and package the complete Ansible implementation	Current

Why

The earlier spike image copied selected Ansible task files and patched main.yml and environ.py inside a derived Dockerfile. That made the image work, but hid the real provisioning implementation from reviewers.

This PR now uses the standard docker-splunk build contract: make ansible fetches one immutable splunk-ansible commit, and the normal Splunk Dockerfile copies that complete tree into /opt/ansible.

What changes

• Pins SPLUNK_ANSIBLE_REF to bb5321b2dc1ce6fbfb29937013afbf4feb5f10b5, the head of draft PR #925.
• Updates the exact-ref test to identify that Noah commit.
• Adds a test proving the normal image Dockerfile copies the complete splunk-ansible tree.

The final diff contains only docker-splunk/Makefile and docker-splunk/tests/test_ansible_ref.py. It does not contain a gitlink change, a selected-file overlay, Python patching of Ansible files, account IDs, or credentials.

Build flow

1. make ansible clones https://github.com/splunk/splunk-ansible.git when the checkout is absent.
2. It fetches and checks out the exact SPLUNK_ANSIBLE_REF in detached mode.
3. It records the resolved SHA in splunk-ansible/version.txt.
4. The existing splunk/common-files/Dockerfile executes COPY splunk-ansible ${SPLUNK_ANSIBLE_HOME}, so all Noah role files and tests come from the reviewed Ansible commit.
5. Existing Docker image targets continue through the same build path; no Noah-only Dockerfile patch layer is required.

Validation

• python3 -m pytest -q -p no:cacheprovider docker-splunk/tests/test_ansible_ref.py: 5 passed.
• A fresh temporary directory ran make ansible using this Makefile.
• The resulting checkout and version.txt both resolved to bb5321b2dc1ce6fbfb29937013afbf4feb5f10b5.
• The fetched tree contains the complete indexer, search-head, and deployer Noah role tasks.
• The PR file list was verified to contain only the two intended files.

This remains a draft spike PR while the resulting image and the SOK runtime stack are validated end to end on the supported Kubernetes environments.