Add ansible-lint and fix all errors and warnings

no-changed-when can be ignored here, as we only execute the surrounding block if the container has to be created. The whole playbook is still idempotent due to that check, only that block in itself is not idempotent - but it doesn't have to be.